Resubmissions

07-01-2025 15:16

250107-sneq2aykej 10

07-01-2025 14:48

250107-r6y2ysvrdw 10

07-01-2025 14:31

250107-rvyl2swrhr 7

07-01-2025 14:23

250107-rqb79awqcq 1

Analysis

  • max time kernel
    900s
  • max time network
    898s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07-01-2025 14:48

General

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ROBLOX EXECUTOR

C2

192.168.50.1:4782

10.0.0.113:4782

LETSQOOO-62766.portmap.host:62766

89.10.178.51:4782

Mutex

90faf922-159d-4166-b661-4ba16af8650e

Attributes
  • encryption_key

    FFEE70B90F5EBED6085600C989F1D6D56E2DEC26

  • install_name

    windows 3543.exe

  • log_directory

    roblox executor

  • reconnect_delay

    3000

  • startup_key

    windows background updater

  • subdirectory

    windows updater

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Decryptfiles.txt

Ransom Note
ATTENTION! Don't worry, you can return your files! All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key. The only method of recovering files is to purchase a decrypt tool and your key. Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned. We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision. Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours. Contact us email: [email protected] [email protected] ID :67F01788D7CA7919B10B5391CFED7417D0E539F4BBEC331ACF11A8C6A00E735F3430B2FA01611D8DAEE5421EC6539BC040B1E5AA2262DB2796BBA9D3F0FC2A89DBDF91E44D486DCA5115E359A735A74953240BFB256BBF9834C9B62E0717D9B7D1D1C2F78C0ABE80458BD4B3B19B368963730753E3041D5BDD8E400A054BCF72E1739415855DE0242E1E4D773C009F2DF6F4C7FF391EA1630FD947D93E22D761A2350D9BE2A4C02E0092AF6E7829134F84C904F288F8ABFEAFAE79228E0911CA24155F4664C77AF371702CF212AEC8D1161450376EE1A9225F4DA99662ACA9C4FE44B592A9C8922BAF1D2771DE101DCADD5C4CA9DE0BB248EC98E9DF27B382B7DE78B326DA1D5A1EB99E5056ADF4B7531F8850E80EFC4F49E626C161C94A692F888A8EA01D83A970F8BAFE14F532C324B40743D5C7B8273C5E9D71632B9CF40716C13D9186916018733B72A2D1F574C5A8972EB4F4541389BB411699F9769BA72CAF423A0596D735C9AE1FC463CB12368D06DA8B79E0B259F186F08F40EB24AF5E0CFD2C4022A3D9EB6E3976D8B2C419850B935EB457811D26E6F4EBC32CAB2501C5695DBC4A3C30FFF8BEB472C9C92C2D03B104B35C59DA7D6A7A79DE92EC0E2EAB17DE1903C5C8D8111E41A182C3A08C3093B311ED032C7C7D0FAAB31014D5B25D8037694CFE084E5AE493050FD5B760505C5AA0B2CF6507AA30294B8A4F86727E7D699598099A4125B04F1E346B0F0AC31535466DBAF4418B91F8E39FBF8471ECD7F44D0BCDEDAA951A46EE8B40C8956A961FBACF45D957674B8FCD58501D7E2250B622E5A34C8E1B7A57D1D97A3B38C0EED9ED1D553A4353AF32A86A728DE3D1B3C467EBB0AF08E9D226BD2EE18B94E278A94FB4154B57FDED63EB045097C103AA1E118EB373B471BA73E4FFA5A1979DE7518C694A0AFE79A42609B7A3E9B4F46827BC09DB7AEB9E953038F0B9C4A7C11BF8B69F8D30F7D02F3B2859DE30D5318425428E1726BF71ECED123C20AEA9F1DE65669A788A1BFC37F5F9AA58AD0A13768211F9156CD80874451AACE2F798D9825C29B2B3FE25565E4EAE487BD81F989AA2EEFFB321DCF450E18B07F3FFA6DCC98196DC0964F0BC05F04430CA562EFCEFE4E3EE1A5EC8B38EA598F009CE47BCF6FCF4803D3995DFC796726AB495AC65072D42A7F5747C31D93438179AF207C5777B465886561EEB60D25F3A40EE5198C63692A4024975EDEBCAF058748854C07C77218B33F79CF79E349A0F9E67CC038C43438752A5B08F78AF8FBC156C679B2257483AF64BD1FD9D21E5FE4D3F2223A0F1ABC6CF3BB3396971B8A9F8FE7B38BED85DD5F2BB876EB5163A1FAA287E3F6847142895AE0F583F864F4CA2B8EA1AD99A137826616F14DEB5A02FC1C331876F810206D3F84F8975C8AFB784C8371216DA2AE694FF3910312730B9CCB3BDF2FA24498A9D5603406D4991CC5CBCF65A3DE221390EA817E7D447FE10E778FC015F806B6FD43704F36067D0F748161D23CE38B15055BD522FA6CC477D096CD9252BD9E7C57CE48850574C44001E7B675CC6D909BD68E73AB5CB5553E23706FA6F30AF742F1611C96BE0D5D4A99A1A8517ADA9E1F2DE0B5E287E96F165124FE43819EC49534DB9B157DB5E08823D43CFCB7E9DE5ADF030E80AE2C55550EE66128BF4CF322C805D1FFF859A177949264A9A5E1D4489CDC599361F6B1A076786ADE61959626E07717D33506D1E76BC7CC838183811FA54D0411D3D99A35C7603E419D5E0A10B71A1384306645A0E25967423BD7C771389D8A976D3BEA963971154D14766F4CB6F45758F89DD24A3AE0B7D25580373E095E8CD0E1AF0A991E1A51B6D81D2753943FE6EB1622CE01E850E8FB7B9DD950BF6430F38564C78496AED82E1C6531BF1F3E3F0873D5AA55583803C3B6195A529A020CBE4AF39ABDDA44FFC7CC234B7FFCC5DC8E3F30B5B572FC7A55874751B303765CC3B0A988D69EACFCE1FABAD64CB8D8044214FC775043E913A67997EDAF642714B3173DD1943FB70C8BC682CE7BD59956CE75ACF82BB747FBF78496885EE489DD3D0DB887C95FBCE74803B81BEC9DA384A6C28A089F4CC577450F05307CC792B035E7BDCAEA9268FFE2D31669AEA272EC6F82529F259EC762CD139471A040345A75B0612D10E8F13BB766B7AC580FC1C9C80F0C7E69AC67FB8339B6DE17885F873795B7B6E7DD3D9055A177DF85BA818020BDD3B5A4B76146A453C48A36E83366173E199709C7DB6F9AFB445BFB3513B94445766D3869643EEAD5206482595E13DB5C7F6217DD7386A598B07FE42EE0DC74091BDF7E3DB2C01FB71A7F04A3BE21C647374D506183BE4B62B299FA6C9DEE8A231

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

    Using powershell.exe command.

  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 4 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 21 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 33 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • NTFS ADS 7 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
  • Runs ping.exe 1 TTPs 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://YouTube.com
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2c54cc40,0x7fff2c54cc4c,0x7fff2c54cc58
      2⤵
        PID:2268
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1824 /prefetch:2
        2⤵
          PID:3640
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1948,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2108 /prefetch:3
          2⤵
            PID:3200
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2160,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:8
            2⤵
              PID:4764
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3000,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3008 /prefetch:1
              2⤵
                PID:2976
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3012,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
                2⤵
                  PID:2828
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3632,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3532 /prefetch:1
                  2⤵
                    PID:3552
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3020,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:1
                    2⤵
                      PID:4960
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4628,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4284 /prefetch:8
                      2⤵
                        PID:1848
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4632,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:8
                        2⤵
                          PID:2376
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4912,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4936 /prefetch:8
                          2⤵
                            PID:1844
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4724,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4884 /prefetch:1
                            2⤵
                              PID:3216
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3136,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5436 /prefetch:8
                              2⤵
                                PID:4872
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4500,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5216 /prefetch:1
                                2⤵
                                  PID:2692
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5472,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5480 /prefetch:8
                                  2⤵
                                    PID:3600
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4436,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5504 /prefetch:8
                                    2⤵
                                      PID:1780
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3728,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5644 /prefetch:8
                                      2⤵
                                      • Subvert Trust Controls: Mark-of-the-Web Bypass
                                      • NTFS ADS
                                      PID:3996
                                    • C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe
                                      "C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      • NTFS ADS
                                      PID:1220
                                      • C:\Windows\SystemTemp\GUM80B.tmp\BraveUpdate.exe
                                        C:\Windows\SystemTemp\GUM80B.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"
                                        3⤵
                                        • Event Triggered Execution: Image File Execution Options Injection
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Drops file in Program Files directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3760
                                        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          PID:1020
                                        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          PID:4668
                                          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
                                            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Modifies registry class
                                            PID:884
                                          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
                                            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Modifies registry class
                                            PID:4488
                                          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe
                                            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Modifies registry class
                                            PID:1536
                                        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntBMTU4NjM3RC05NjI0LTRGQTUtOEI0MS1GRERBOTMzREYyQ0J9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RUE0NjQwNTUtMEUzRC00RTk4LUI0QjgtMjQyRTkxMUIyREEyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0IxMzFDOTM1LTlCRTYtNDFEQS05NTk5LTFGNzc2QkVCODAxOX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4zNjEuMTUxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9Ijc0NiIvPjwvYXBwPjwvcmVxdWVzdD4
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          PID:1464
                                        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{A158637D-9624-4FA5-8B41-FDDA933DF2CB}"
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:1412
                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                    1⤵
                                      PID:1824
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004DC
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3800
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                      1⤵
                                        PID:2116
                                      • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
                                        1⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Drops file in Program Files directory
                                        • System Location Discovery: System Language Discovery
                                        PID:3628
                                        • C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\brave_installer-x64.exe
                                          "C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\gui586E.tmp"
                                          2⤵
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3468
                                          • C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe
                                            "C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\gui586E.tmp" --brave-referral-code="BRV002"
                                            3⤵
                                            • Boot or Logon Autostart Execution: Active Setup
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Drops file in Windows directory
                                            • Modifies registry class
                                            PID:4668
                                            • C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe
                                              "C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff7c3ccf418,0x7ff7c3ccf424,0x7ff7c3ccf430
                                              4⤵
                                              • Executes dropped EXE
                                              PID:1112
                                            • C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe
                                              "C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\gui586E.tmp" --create-shortcuts=0 --install-level=1
                                              4⤵
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              PID:1068
                                              • C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe
                                                "C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7c3ccf418,0x7ff7c3ccf424,0x7ff7c3ccf430
                                                5⤵
                                                • Executes dropped EXE
                                                PID:2376
                                        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntBMTU4NjM3RC05NjI0LTRGQTUtOEI0MS1GRERBOTMzREYyQ0J9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MTRGMjk3MTQtRjZENy00OTYyLUEzRTYtMkJBOEFGQUExRUM1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0FGRTZBNDYyLUM1NzQtNEI4QS1BRjQzLTRDQzYwREY0NTYzQn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzMS4xLjczLjEwNCIgYXA9InJlbGVhc2UiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwczovL3VwZGF0ZXMtY2RuLmJyYXZlc29mdHdhcmUuY29tL2J1aWxkL0JyYXZlLVJlbGVhc2UvcmVsZWFzZS93aW4vMTMxLjEuNzMuMTA0L3g2NC9icmF2ZV9pbnN0YWxsZXIteDY0LmV4ZSIgZG93bmxvYWRlZD0iMTMwOTI4NjU2IiB0b3RhbD0iMTMwOTI4NjU2IiBkb3dubG9hZF90aW1lX21zPSIxMTkwNyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjk2IiBkb3dubG9hZF90aW1lX21zPSIxMjgzMCIgZG93bmxvYWRlZD0iMTMwOTI4NjU2IiB0b3RhbD0iMTMwOTI4NjU2IiBpbnN0YWxsX3RpbWVfbXM9IjI5OTY5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1264
                                      • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe
                                        "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding
                                        1⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:3516
                                        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:3200
                                          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer
                                            3⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Checks system information in the registry
                                            • Drops file in Windows directory
                                            • Enumerates system info in registry
                                            • Modifies system certificate store
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:1600
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff17a91d18,0x7fff17a91d24,0x7fff17a91d30
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:3432
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2036,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2032 /prefetch:2
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:4376
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --field-trial-handle=1892,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2192 /prefetch:11
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:1104
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2368,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2588 /prefetch:13
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:1004
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3448,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3460 /prefetch:1
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:1032
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3464,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3608 /prefetch:1
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:1856
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5076,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4772 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:3628
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4696,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4908 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:4356
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4132,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5200 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:2452
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5224,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5360 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:560
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4672,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5528 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:1612
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5524,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5380 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:3404
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5116,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3432 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:3436
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                              4⤵
                                              • Executes dropped EXE
                                              PID:5036
                                              • C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe
                                                "C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7f57cf418,0x7ff7f57cf424,0x7ff7f57cf430
                                                5⤵
                                                • Executes dropped EXE
                                                PID:3384
                                              • C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe
                                                "C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious use of FindShellTrayWindow
                                                PID:2104
                                                • C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe
                                                  "C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7f57cf418,0x7ff7f57cf424,0x7ff7f57cf430
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:3092
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5924,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5340 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:8
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6064,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6088 /prefetch:1
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:1264
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5576,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5172 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:4900
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6228,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5648 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:5100
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5744,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5748 /prefetch:1
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:3664
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5652,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5552 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:1564
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5496,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4920 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:3960
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6036,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5932 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              PID:4776
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4736,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6068 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              PID:4604
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=3700,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4148 /prefetch:1
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2036
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6168,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3620 /prefetch:1
                                              4⤵
                                              • Executes dropped EXE
                                              PID:1060
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3716,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4076 /prefetch:1
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2484
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5604,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5512 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious use of SetWindowsHookEx
                                              PID:664
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5616,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5092 /prefetch:1
                                              4⤵
                                              • Executes dropped EXE
                                              PID:1532
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=2884,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5104 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              PID:664
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6180,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5624 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              PID:5016
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4824,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6196 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              PID:5024
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5468,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5456 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              • Subvert Trust Controls: Mark-of-the-Web Bypass
                                              • NTFS ADS
                                              PID:2904
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6304,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6148 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2692
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6104,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5492 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              PID:1220
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5152,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3696 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              PID:5040
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=2956,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5404 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              PID:4720
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=5176,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2952 /prefetch:1
                                              4⤵
                                              • Executes dropped EXE
                                              PID:4604
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3696,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6300 /prefetch:14
                                              4⤵
                                              • Executes dropped EXE
                                              PID:3224
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6148,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5776 /prefetch:1
                                              4⤵
                                              • Executes dropped EXE
                                              PID:4788
                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=6648,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6664 /prefetch:1
                                              4⤵
                                                PID:4972
                                              • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6644,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5156 /prefetch:1
                                                4⤵
                                                  PID:3940
                                                • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=3668,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6740 /prefetch:1
                                                  4⤵
                                                    PID:3620
                                                  • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                    "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=2888,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5648 /prefetch:14
                                                    4⤵
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3752
                                                  • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                    "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4920,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=788 /prefetch:14
                                                    4⤵
                                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                    • NTFS ADS
                                                    PID:724
                                                  • C:\Users\Admin\Desktop\systeminformer-3.2.25004-release-setup.exe
                                                    "C:\Users\Admin\Desktop\systeminformer-3.2.25004-release-setup.exe"
                                                    4⤵
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    PID:480
                                                    • C:\Program Files\SystemInformer\SystemInformer.exe
                                                      "C:\Program Files\SystemInformer\SystemInformer.exe" -channel release
                                                      5⤵
                                                      • Checks SCSI registry key(s)
                                                      • Checks processor information in registry
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      PID:132
                                                      • C:\Windows\explorer.exe
                                                        "C:\Windows\explorer.exe" /select,"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                        6⤵
                                                          PID:5840
                                                        • C:\Windows\explorer.exe
                                                          "C:\Windows\explorer.exe" /select,"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                          6⤵
                                                            PID:5948
                                                      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=5104,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7232 /prefetch:1
                                                        4⤵
                                                          PID:3044
                                                        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4772,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5500 /prefetch:10
                                                          4⤵
                                                            PID:2924
                                                          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=5932,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7552 /prefetch:1
                                                            4⤵
                                                              PID:3216
                                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=6252,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7340 /prefetch:1
                                                              4⤵
                                                                PID:1192
                                                              • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=4700,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5480 /prefetch:1
                                                                4⤵
                                                                  PID:3236
                                                                • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7344,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7776 /prefetch:14
                                                                  4⤵
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1972
                                                                • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7040,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6116 /prefetch:14
                                                                  4⤵
                                                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                  • NTFS ADS
                                                                  PID:840
                                                                • C:\Users\Admin\Desktop\Crawl.exe
                                                                  "C:\Users\Admin\Desktop\Crawl.exe"
                                                                  4⤵
                                                                  • Drops startup file
                                                                  • Adds Run key to start application
                                                                  • Drops desktop.ini file(s)
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:3964
                                                                  • \??\c:\Windows\system32\wbem\wmic.exe
                                                                    c:\RyTdUA\RyTd\..\..\Windows\RyTd\RyTd\..\..\system32\RyTd\RyTd\..\..\wbem\RyTd\RyTdU\..\..\wmic.exe shadowcopy delete
                                                                    5⤵
                                                                      PID:3844
                                                                    • \??\c:\Windows\system32\wbem\wmic.exe
                                                                      c:\WeKbJG\WeKb\..\..\Windows\WeKb\WeKb\..\..\system32\WeKb\WeKb\..\..\wbem\WeKb\WeKbJ\..\..\wmic.exe shadowcopy delete
                                                                      5⤵
                                                                        PID:5136
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Desktop\Crawl.exe"
                                                                        5⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        PID:5192
                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                          ping 1.1.1.1 -n 1 -w 3000
                                                                          6⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          • Runs ping.exe
                                                                          PID:5248
                                                                    • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                      "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=7512,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6816 /prefetch:1
                                                                      4⤵
                                                                        PID:6048
                                                                      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7656,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7528 /prefetch:14
                                                                        4⤵
                                                                        • Modifies registry class
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:6136
                                                                      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7644,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7652 /prefetch:14
                                                                        4⤵
                                                                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                        • NTFS ADS
                                                                        PID:3052
                                                                      • C:\Users\Admin\Desktop\lifework.exe
                                                                        "C:\Users\Admin\Desktop\lifework.exe"
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3800
                                                                      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=7516,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7264 /prefetch:1
                                                                        4⤵
                                                                          PID:5848
                                                                        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5320,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7828 /prefetch:14
                                                                          4⤵
                                                                          • Modifies registry class
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:5560
                                                                        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=5776,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5740 /prefetch:1
                                                                          4⤵
                                                                            PID:2948
                                                                          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6616,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5404 /prefetch:14
                                                                            4⤵
                                                                            • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                            • NTFS ADS
                                                                            PID:3408
                                                                          • C:\Users\Admin\Desktop\setup.exe
                                                                            "C:\Users\Admin\Desktop\setup.exe"
                                                                            4⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5240
                                                                          • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                            "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=6364,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7684 /prefetch:1
                                                                            4⤵
                                                                              PID:3544
                                                                            • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                              "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=5700,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5448 /prefetch:1
                                                                              4⤵
                                                                                PID:284
                                                                              • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=5800,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7384 /prefetch:1
                                                                                4⤵
                                                                                  PID:488
                                                                                • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=6568,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3640 /prefetch:1
                                                                                  4⤵
                                                                                    PID:5696
                                                                                  • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                    "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=784,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6224 /prefetch:1
                                                                                    4⤵
                                                                                      PID:1288
                                                                                    • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                      "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5548,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6308 /prefetch:14
                                                                                      4⤵
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:1616
                                                                                    • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                      "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=5728,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7848 /prefetch:1
                                                                                      4⤵
                                                                                        PID:664
                                                                                      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7712,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6052 /prefetch:14
                                                                                        4⤵
                                                                                        • Modifies registry class
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1824
                                                                                      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=1600,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7524 /prefetch:14
                                                                                        4⤵
                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1268
                                                                                      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=1596,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7740 /prefetch:14
                                                                                        4⤵
                                                                                        • Modifies registry class
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:3628
                                                                                      • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                        "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=7728,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7780 /prefetch:1
                                                                                        4⤵
                                                                                          PID:6012
                                                                                        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4904,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5848 /prefetch:14
                                                                                          4⤵
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2684
                                                                                        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5144,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5852 /prefetch:14
                                                                                          4⤵
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:3712
                                                                                        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5096,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2728 /prefetch:14
                                                                                          4⤵
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5044
                                                                                        • C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
                                                                                          "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=4064,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7524 /prefetch:1
                                                                                          4⤵
                                                                                            PID:1268
                                                                                          • C:\Users\Admin\Desktop\JJSPLOIT.V2.exe
                                                                                            "C:\Users\Admin\Desktop\JJSPLOIT.V2.exe"
                                                                                            4⤵
                                                                                              PID:1228
                                                                                      • C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\elevation_service.exe
                                                                                        "C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\elevation_service.exe"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:3292
                                                                                      • C:\Users\Admin\Desktop\JJSPLOIT.V2.exe
                                                                                        "C:\Users\Admin\Desktop\JJSPLOIT.V2.exe"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1220
                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                          "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                          2⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:1184
                                                                                        • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5040
                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                            "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                            3⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:3960
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bYi71pmtGKL3.bat" "
                                                                                            3⤵
                                                                                              PID:4392
                                                                                              • C:\Windows\system32\chcp.com
                                                                                                chcp 65001
                                                                                                4⤵
                                                                                                  PID:4020
                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                  ping -n 10 localhost
                                                                                                  4⤵
                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                  • Runs ping.exe
                                                                                                  PID:2876
                                                                                                • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                  4⤵
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:2124
                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                    "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                    5⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:4584
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6yz9MHWb13ZD.bat" "
                                                                                                    5⤵
                                                                                                      PID:1176
                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                        chcp 65001
                                                                                                        6⤵
                                                                                                          PID:4120
                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                          ping -n 10 localhost
                                                                                                          6⤵
                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                          • Runs ping.exe
                                                                                                          PID:5052
                                                                                                        • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                          6⤵
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:1408
                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                            "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                            7⤵
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:3616
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c0kxms7p1I7T.bat" "
                                                                                                            7⤵
                                                                                                              PID:5384
                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                chcp 65001
                                                                                                                8⤵
                                                                                                                  PID:5428
                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                  ping -n 10 localhost
                                                                                                                  8⤵
                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                  • Runs ping.exe
                                                                                                                  PID:5444
                                                                                                                • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                  8⤵
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:5784
                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                    "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                    9⤵
                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                    PID:5828
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egfSWRcN9MPE.bat" "
                                                                                                                    9⤵
                                                                                                                      PID:5276
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        10⤵
                                                                                                                          PID:4992
                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                          ping -n 10 localhost
                                                                                                                          10⤵
                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:5328
                                                                                                                        • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                          10⤵
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:1060
                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                            "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                            11⤵
                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                            PID:2240
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZzoHW03RxyKU.bat" "
                                                                                                                            11⤵
                                                                                                                              PID:4024
                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                chcp 65001
                                                                                                                                12⤵
                                                                                                                                  PID:5288
                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                  ping -n 10 localhost
                                                                                                                                  12⤵
                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                  • Runs ping.exe
                                                                                                                                  PID:5768
                                                                                                                                • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                                  12⤵
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:3948
                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                    "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                                    13⤵
                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                    PID:6096
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Q4IAMmY6L1dO.bat" "
                                                                                                                                    13⤵
                                                                                                                                      PID:5980
                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                        chcp 65001
                                                                                                                                        14⤵
                                                                                                                                          PID:6016
                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                          ping -n 10 localhost
                                                                                                                                          14⤵
                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                          • Runs ping.exe
                                                                                                                                          PID:308
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                                          "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                                          14⤵
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:2340
                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                            "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                                            15⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:3880
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RR9uj9w0JM6m.bat" "
                                                                                                                                            15⤵
                                                                                                                                              PID:1608
                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                chcp 65001
                                                                                                                                                16⤵
                                                                                                                                                  PID:1596
                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                  16⤵
                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                  • Runs ping.exe
                                                                                                                                                  PID:2972
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                                                  16⤵
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:5480
                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                    "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                                                    17⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:1480
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\in3UR5rnLOQg.bat" "
                                                                                                                                                    17⤵
                                                                                                                                                      PID:2524
                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                        chcp 65001
                                                                                                                                                        18⤵
                                                                                                                                                          PID:3056
                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                          18⤵
                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:6116
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                                                          18⤵
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:5800
                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                            "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                                                            19⤵
                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                            PID:5408
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKaNuwIcCmuW.bat" "
                                                                                                                                                            19⤵
                                                                                                                                                              PID:5556
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                20⤵
                                                                                                                                                                  PID:5136
                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                  20⤵
                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                  PID:2248
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                                                                  20⤵
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:1204
                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                    "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                                                                    21⤵
                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                    PID:6080
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Dpu8WSTHyaGd.bat" "
                                                                                                                                                                    21⤵
                                                                                                                                                                      PID:4160
                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                        chcp 65001
                                                                                                                                                                        22⤵
                                                                                                                                                                          PID:6016
                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                          22⤵
                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                          PID:4584
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                                                                          22⤵
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:5720
                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                            "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                                                                            23⤵
                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                            PID:3948
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2b6Bs617S0KY.bat" "
                                                                                                                                                                            23⤵
                                                                                                                                                                              PID:6084
                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                chcp 65001
                                                                                                                                                                                24⤵
                                                                                                                                                                                  PID:3388
                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                  24⤵
                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  PID:4412
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                                                                                  24⤵
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:5776
                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                    "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                                                                                    25⤵
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:5292
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5GC9UgiDLEOK.bat" "
                                                                                                                                                                                    25⤵
                                                                                                                                                                                      PID:3640
                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                        26⤵
                                                                                                                                                                                          PID:5268
                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                          26⤵
                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                          PID:4632
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                                                                                          26⤵
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:5016
                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                            "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                                                                                            27⤵
                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                            PID:5540
                                                                                                                                      • C:\Users\Admin\Desktop\JJSPLOIT.V2.exe
                                                                                                                                        "C:\Users\Admin\Desktop\JJSPLOIT.V2.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:1188
                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                          1⤵
                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                          PID:4048
                                                                                                                                        • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                          "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c
                                                                                                                                          1⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5456
                                                                                                                                          • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                            "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr
                                                                                                                                            2⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5544
                                                                                                                                          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe
                                                                                                                                            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"
                                                                                                                                            2⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5564
                                                                                                                                          • C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe
                                                                                                                                            "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"
                                                                                                                                            2⤵
                                                                                                                                              PID:5568
                                                                                                                                            • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                              "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core
                                                                                                                                              2⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5596
                                                                                                                                          • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                            "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler
                                                                                                                                            1⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5464
                                                                                                                                          • C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
                                                                                                                                            "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
                                                                                                                                            1⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2444
                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                            1⤵
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • Modifies registry class
                                                                                                                                            PID:3888
                                                                                                                                            • C:\Windows\system32\srtasks.exe
                                                                                                                                              C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                              2⤵
                                                                                                                                                PID:5408
                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 517F222E4D9F1A2F332DF5BE49DA9B10
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5580
                                                                                                                                              • C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
                                                                                                                                                "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" -deploymentID c08f7d01-8822-4b91-a823-3406ea47c35d -askForName=0
                                                                                                                                                2⤵
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:6036
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:6100
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:2516
                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 1789741AE1A39FD47A9464AC988B6835 E Global\MSI0000
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:6012
                                                                                                                                            • C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
                                                                                                                                              "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
                                                                                                                                              1⤵
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:72
                                                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "
                                                                                                                                                2⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                PID:2520
                                                                                                                                            • C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
                                                                                                                                              "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
                                                                                                                                              1⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1468
                                                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20220420175353\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "
                                                                                                                                                2⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                PID:5216
                                                                                                                                            • C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
                                                                                                                                              "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
                                                                                                                                              1⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:4564
                                                                                                                                              • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FleetDeck Agent Service" /VE /T REG_SZ /F /D Service
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5796
                                                                                                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Set-NetFirewallRule -Name 'FleetDeck Agent Service Command' -Program 'C:\Program Files (x86)\FleetDeck Agent\20220420175353\fleetdeck_agent.exe'"
                                                                                                                                                2⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                PID:5812
                                                                                                                                              • C:\Program Files (x86)\FleetDeck Agent\20220420175353\fleetdeck_agent.exe
                                                                                                                                                "C:\Program Files (x86)\FleetDeck Agent\20220420175353\fleetdeck_agent.exe"
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3360
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Domain))"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:3232
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Status))"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:5304
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Manufacturer))"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:4992
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Model))"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:5556
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Get-WmiObject win32_physicalmemory | select -expandproperty Capacity | Measure-Object -Sum | select -expandproperty Sum"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:3796
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Caption))"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:5252
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Version))"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:3920
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_bios | select -expandproperty SerialNumber))"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:6112
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "([WMI] '').ConvertToDateTime((Get-WmiObject win32_operatingsystem | select -expandproperty LastBootUpTime)).ToUniversalTime().ToString('o')"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:6104
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_videocontroller | select -expandproperty Name)"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:6060
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_processor | select -expandproperty Name)"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:6040
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).NdisMedium | Select-Object -First 1 "
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:2412
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).MacAddress "
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:5048
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty OSArchitecture))"
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:4584
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " function Test-PendingFileRename { [OutputType('bool')] [CmdletBinding()] param() $operations = (Get-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\').GetValue('PendingFileRenameOperations') if ($null -eq $operations) { $false } else { $trueOperationsCount = $operations.Length / 2 $trueRenames = [System.Collections.Generic.Dictionary[string, string]]::new($trueOperationsCount) for ($i = 0; $i -ne $trueOperationsCount; $i++) { $operationSource = $operations[$i * 2] $operationDestination = $operations[$i * 2 + 1] if ($operationDestination.Length -eq 0) { } else { $trueRenames[$operationSource] = $operationDestination } } $trueRenames.Count -gt 0 } } if (Get-ChildItem \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending\" -EA Ignore) { return 1 } if (Get-Item \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\" -EA Ignore) { return 1 } if (Test-PendingFileRename) { return 1 } try { $util = [wmiclass]\"\\.\root\ccm\clientsdk:CCM_ClientUtilities\" $status = $util.DetermineIfRebootPending() if(($status -ne $null) -and $status.RebootPending){ return 1 } }catch{} return 0 "
                                                                                                                                                  3⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:3500
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                              1⤵
                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                              • Modifies registry class
                                                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:5220
                                                                                                                                              • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\windows updater\Decryptfiles.txt
                                                                                                                                                2⤵
                                                                                                                                                  PID:864
                                                                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:1696
                                                                                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Decryptfiles.txt
                                                                                                                                                  1⤵
                                                                                                                                                  • Opens file in notepad (likely ransom note)
                                                                                                                                                  PID:5708
                                                                                                                                                • C:\Users\Admin\Desktop\lifework.exe
                                                                                                                                                  "C:\Users\Admin\Desktop\lifework.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3784
                                                                                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Decryptfiles.txt
                                                                                                                                                  1⤵
                                                                                                                                                  • Opens file in notepad (likely ransom note)
                                                                                                                                                  PID:1460
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:2692

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Config.Msi\e5e5804.rbs

                                                                                                                                                  Filesize

                                                                                                                                                  219KB

                                                                                                                                                  MD5

                                                                                                                                                  589c2ad695fde2765b3b817c0c32ddde

                                                                                                                                                  SHA1

                                                                                                                                                  222f05891bf62ebe57f9c3884524052831fd4854

                                                                                                                                                  SHA256

                                                                                                                                                  d9474ef1db4a39895e9fef2a185cfb10f6328f90fb71c10a2811340c6c7bcfa7

                                                                                                                                                  SHA512

                                                                                                                                                  5f92db70726e82e8d277b40cfdfc7fbd3ac5eb3a288e40e074f789d60a5d4edc65e4a7cc8f76211db5c5b8aaa397191d14ba4bf4a1374701ed0a1586c04e76ad

                                                                                                                                                • C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\setup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  4.3MB

                                                                                                                                                  MD5

                                                                                                                                                  94483ea960f9bee9044e0a8ca31fc33c

                                                                                                                                                  SHA1

                                                                                                                                                  39e29cde48af84b3efdf16ffeacdc35be3e0e1e5

                                                                                                                                                  SHA256

                                                                                                                                                  e308f70103afbfac265121f89759906299213e88fb9802352695f8260bd3d31c

                                                                                                                                                  SHA512

                                                                                                                                                  d189adf07c6715d38547bd8873234d16596970d671ba3fb9c222d6a9aa10a5fc7cdcc6cea6627c5b0031b93e60e6db18e45b2661532873f510151a9b3f1fcb94

                                                                                                                                                • C:\Program Files\SystemInformer\SystemInformer.exe

                                                                                                                                                  Filesize

                                                                                                                                                  3.3MB

                                                                                                                                                  MD5

                                                                                                                                                  ad845b34379404be8224d2ac570d4f6f

                                                                                                                                                  SHA1

                                                                                                                                                  e197c7423c97cd802d67f944429e83a5bae3dac3

                                                                                                                                                  SHA256

                                                                                                                                                  0c44bc05baec15de76da5074dd96fe19c81f3aa82da628c57555addc77bb0fa8

                                                                                                                                                  SHA512

                                                                                                                                                  abc8d3b9fb90384cf4f2ff73d989227add3aa4f9686a9f7c243f2e52983349bdb92f7b700cbe5f7c27c1867b7aebd1c61f62008145087e47eee58cf2b9aebdc4

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\7a012be2-2bbf-4145-b637-1837f8aadb49.tmp

                                                                                                                                                  Filesize

                                                                                                                                                  51KB

                                                                                                                                                  MD5

                                                                                                                                                  128f1298bd370339c033d8aba64d54d1

                                                                                                                                                  SHA1

                                                                                                                                                  51d420c541de842a64daff936f1fa0a28630a944

                                                                                                                                                  SHA256

                                                                                                                                                  73a2bb0d4abfc9216bcec82388a66de71ffe183f670354e9c924b3c21a1fc4df

                                                                                                                                                  SHA512

                                                                                                                                                  cbc60a795be8638e77554a406a169efc5445df9d25a54999422e00ccdee666c1678ace3542c5dac8e19fcd0dd33b8453a8e7f40e53c84dc32562e66eed306489

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\CertificateRevocation\9462\crl-set

                                                                                                                                                  Filesize

                                                                                                                                                  626KB

                                                                                                                                                  MD5

                                                                                                                                                  4cccfca2d549f6bf9e421bb367025d43

                                                                                                                                                  SHA1

                                                                                                                                                  63113e18dd6320880b6baaac408ebeba1846b1ee

                                                                                                                                                  SHA256

                                                                                                                                                  a729eccd37e7e2c24a53b900b6c6b1db34958cb931024d26b63f886c321e27d9

                                                                                                                                                  SHA512

                                                                                                                                                  afccc3e734603efad0b527b2160445f4f4d5160a284b895fcaf8f41afc2524a6da56686a1f9745e0703b4283def6343adde33c750bb5643968b7e32826288a53

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crowd Deny\2024.12.19.1218\Preload Data

                                                                                                                                                  Filesize

                                                                                                                                                  16KB

                                                                                                                                                  MD5

                                                                                                                                                  3c97222c910c2aa1fab0c39a1c8d2b11

                                                                                                                                                  SHA1

                                                                                                                                                  c794a8758b4fa74c7aa9536effe9bfa774822e7a

                                                                                                                                                  SHA256

                                                                                                                                                  c7b91efdd09d75b47036e241eb55a238065ace2c26cd8f31328e8a9f4b4102b4

                                                                                                                                                  SHA512

                                                                                                                                                  3220065c655bf174c466d9ac03d3040e419f30d081983c23a757d2c0c5e4720aed2c71e88befc0d8b6987d6abd6a25289731d7f4fc9ed6348a1d762f67032153

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\3b0a18f4-015b-42ac-ba7e-9bf1d163f2b8.tmp

                                                                                                                                                  Filesize

                                                                                                                                                  165KB

                                                                                                                                                  MD5

                                                                                                                                                  dceb0cfa9b61effc8788488f43747572

                                                                                                                                                  SHA1

                                                                                                                                                  c43235ebfd21469a747e8a264b67f874e0400cb9

                                                                                                                                                  SHA256

                                                                                                                                                  4f6f8abe6e2a6bbfea1c79b495019e80015343160d7fd99ecd0d428c9a8fd57a

                                                                                                                                                  SHA512

                                                                                                                                                  a4f5775c654fa4f31f53cb6fbab084939bd929feb95740b904045cd1f0a52c819e90876e56e66f7d1bb38db66fa0cb49c7365511f8346eec3cdc610e32b02c6b

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\BraveWallet\Brave Wallet Storage\MANIFEST-000001

                                                                                                                                                  Filesize

                                                                                                                                                  41B

                                                                                                                                                  MD5

                                                                                                                                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                  SHA1

                                                                                                                                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                  SHA256

                                                                                                                                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                  SHA512

                                                                                                                                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000002

                                                                                                                                                  Filesize

                                                                                                                                                  23KB

                                                                                                                                                  MD5

                                                                                                                                                  f837d382a885a07c34a3d4bf4f49373d

                                                                                                                                                  SHA1

                                                                                                                                                  68ddceef1d164a48d9d01d4a74f26b7897323229

                                                                                                                                                  SHA256

                                                                                                                                                  dd05e326cf8eac3b55acecf29c842ed73e6e6dd06491cf47f7e8800680ab3e33

                                                                                                                                                  SHA512

                                                                                                                                                  ef010d89971c4f69af7bf541430364c56245a5b63ed730fe628e49f48fa9e201c7f42b1e104eb14c3193bf79dd7ce20244f6b963e9996eb8308c0d61f444ece6

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000003

                                                                                                                                                  Filesize

                                                                                                                                                  23KB

                                                                                                                                                  MD5

                                                                                                                                                  75fb76ec35595f04717e8b3f1dc3ae2a

                                                                                                                                                  SHA1

                                                                                                                                                  91770c8b9979c8245519e9c5078ca10a47524169

                                                                                                                                                  SHA256

                                                                                                                                                  62553d159189834af73c9a6264704be5b2bee9a08da66a14768d8e5c6ffd2cdb

                                                                                                                                                  SHA512

                                                                                                                                                  4f05ec0c9a34ecacb19bd13aec6a15794951bd42b005986967b2d8b347cdce22fe8edb0b7d24d3e470416deb01fa69c0bf0fa5ae07eda3cefc26b0073dc9b62a

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000004

                                                                                                                                                  Filesize

                                                                                                                                                  18KB

                                                                                                                                                  MD5

                                                                                                                                                  35792e91f123eadc87b14296d581f180

                                                                                                                                                  SHA1

                                                                                                                                                  f283c2e274c1d35c37da9039bd8f6d33ab6f59fb

                                                                                                                                                  SHA256

                                                                                                                                                  b8a10ebaaf8455b1b99b52e47691977409de4a2fcff998986a4800107dffd9d7

                                                                                                                                                  SHA512

                                                                                                                                                  f172630d4767fa0f34afd173c159726eb692d8d91bc8a50a66d05d8e033502f4ccb2efe77a8160f036e6ade16f5bd49a23be7f768d30c528ecfb60a9d282965c

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000005

                                                                                                                                                  Filesize

                                                                                                                                                  22KB

                                                                                                                                                  MD5

                                                                                                                                                  2949c26c74d6758b0b24f8a087e85c74

                                                                                                                                                  SHA1

                                                                                                                                                  f4cc6e8482666d0efd96c4ac1b6f7b349437a226

                                                                                                                                                  SHA256

                                                                                                                                                  f87def0570c79571382758bbbed81d3c35c3417c0ee61854328e1e9f6aa2c761

                                                                                                                                                  SHA512

                                                                                                                                                  8c1866d924767a78590406be1757dc8a54115575015b3dd07f958493fb97aaddefb9082927f65d53ca28edc9960a6fdb05bcfc98a909aaaa016698c29d0a7b34

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000006

                                                                                                                                                  Filesize

                                                                                                                                                  30KB

                                                                                                                                                  MD5

                                                                                                                                                  70cce0c43ef9e0847c85a44aadd7633c

                                                                                                                                                  SHA1

                                                                                                                                                  189ad874a1cf3ebac80a44f7abd3e73b299f0956

                                                                                                                                                  SHA256

                                                                                                                                                  5f17b5408d534184584987c8ff8739e36ad842967808797a3e2a8a94f21b47e9

                                                                                                                                                  SHA512

                                                                                                                                                  5528cd156aa970f17492438fd08056d4c12c3f2378c3bcc322f3a74343ea8e17428a0b1f720d6309667b959ba19621fc7a4d1c5ef4a8264bace934329e8dbaf6

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000007

                                                                                                                                                  Filesize

                                                                                                                                                  20KB

                                                                                                                                                  MD5

                                                                                                                                                  384eee9b1824c7b379821d39bb576312

                                                                                                                                                  SHA1

                                                                                                                                                  40c5913ca8f24b69815274b63c7997427face95b

                                                                                                                                                  SHA256

                                                                                                                                                  fd5cd1725025f64c168ee10c9abd38061debb4d8b89e6ea2562e61d8f337e07a

                                                                                                                                                  SHA512

                                                                                                                                                  032be9942a2cda49a73c0e7ed25b2cbcb25457669a18c32429587c5539c0c81bfb8ac49fb83c7d71bb9652eb230dfacc13e4e55c8934e5a780cc9e1d2d56ac51

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000008

                                                                                                                                                  Filesize

                                                                                                                                                  51KB

                                                                                                                                                  MD5

                                                                                                                                                  9e928f6729f8c22031b806b09764bc92

                                                                                                                                                  SHA1

                                                                                                                                                  60ab632564ed0c5326a2af4a1e8bc264fa74b364

                                                                                                                                                  SHA256

                                                                                                                                                  fbd213e02e7447d8cd862822dec1678944662030ea2297450affc4896de36186

                                                                                                                                                  SHA512

                                                                                                                                                  a48d9037ccb14a1e7f5b9fd296313871a228b9448132a3e6b0037e4b996396bc09395ee62129bbf2c85ee703a648c6e48ff23c98283fc0b622b23b301dc002e7

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000009

                                                                                                                                                  Filesize

                                                                                                                                                  16KB

                                                                                                                                                  MD5

                                                                                                                                                  8644afbdd38d39b25563719b4361e2be

                                                                                                                                                  SHA1

                                                                                                                                                  7db803e3047a7fe376f292b709441d7a3c61252a

                                                                                                                                                  SHA256

                                                                                                                                                  f81e5823e71ad1b84befd090f8e5da2c6e3d3bc1f326b39cf58328fc6bda561b

                                                                                                                                                  SHA512

                                                                                                                                                  cc41c4026662a4a66e3fed27880d2f3769b19b71cb30814cf45b95994bcd938984d6b7876b8f688dac592741c5fe19fdb42bbd3c09f25bac4458d49bfd0421f1

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\CdmStorage.db

                                                                                                                                                  Filesize

                                                                                                                                                  160KB

                                                                                                                                                  MD5

                                                                                                                                                  e9fcb41b1fee21cd572a91184c8c23b8

                                                                                                                                                  SHA1

                                                                                                                                                  699099abc30e0d96c364a68f967bd2e26a1535b7

                                                                                                                                                  SHA256

                                                                                                                                                  68590788b1ba533d2f2ca85f81dc711238a37a095722823f5651177b38fc2b61

                                                                                                                                                  SHA512

                                                                                                                                                  30393a706900f3ab4f16ff326a7a9da68863ee254c2c9bb5d8bcfc95239f919b8bb3c392c064c1bfb86c23344769ded300f2c11284ecf89ee8a09d5284f968cd

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  95b314534b86e6741fa86a5357080431

                                                                                                                                                  SHA1

                                                                                                                                                  a079a66bae8b16675022a9329f05df2fda460207

                                                                                                                                                  SHA256

                                                                                                                                                  8dd3b72d2fee2029a10df34cf1de5242705869552c5b1d5ebaa05ff20fc54c28

                                                                                                                                                  SHA512

                                                                                                                                                  02441946bb32c6d1094868479df936a0e6c6e0fe55421ecd650b9686424a574b9ba0444514c6b050b8fe698b941dcb13d348766ab6fcf3f1c751df8c1ddb8ae5

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  9cc64b0b81c291c75e741e97f10c2a47

                                                                                                                                                  SHA1

                                                                                                                                                  9220cfb8912ffb882868ad47f92395d61deffcbb

                                                                                                                                                  SHA256

                                                                                                                                                  d9c70ac61395a2c241439c76ec209e9d96f3ce7e9031aee05de3ba03ae473b0b

                                                                                                                                                  SHA512

                                                                                                                                                  5d0518ec9d04c32a39a75a08346b369d91465c8ec6d3f352b817dcf66ff3b4b4797ce2135ead9a5efdca3e4a5a034662b21a4e1d58d4498973f4c11d961d810b

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  MD5

                                                                                                                                                  3ce239ce3159f405db8d3e1b21a4b6b2

                                                                                                                                                  SHA1

                                                                                                                                                  6dc36c002a8ffd00d1295ebb36e8dc00f7d9ad24

                                                                                                                                                  SHA256

                                                                                                                                                  7889720436d7f9d8dd7d238fec75611071fec413c069eefcccb140f1b0b5370b

                                                                                                                                                  SHA512

                                                                                                                                                  b87c2493993e61e78d712627880565e8a591d64fa2ba7a4b5bef8ecff2d1d2cced8c315382b8290022c53f83c59a0474c031ad21920e2173fb1a81c41362bb51

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  dbb22715582ee3e2766ca3ad1b1ab5f4

                                                                                                                                                  SHA1

                                                                                                                                                  7a73253da08732c631a9a0e988e660c8f036ca2d

                                                                                                                                                  SHA256

                                                                                                                                                  e59e83a5dbf639a7594fc98bc1abdb441714087d79843f4f6ce26845de6175ff

                                                                                                                                                  SHA512

                                                                                                                                                  5963aa9c46bd5bde2d0d55a2c9541a7feb55a4e6f4938983f9b6cd55f419378183b41bbd0b208db0dd9f97cac346a1eaba59e37e459f2ee542c15910d4fee9c1

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  48B

                                                                                                                                                  MD5

                                                                                                                                                  b4ba54c218cf91a4b2996c1f19b189d6

                                                                                                                                                  SHA1

                                                                                                                                                  ee1951ac32f458b5071bdb81d83a64e08863587f

                                                                                                                                                  SHA256

                                                                                                                                                  720093a30eb05baf985249f9fc7c0e799e5535dd19f06090918d1e2c00e9998e

                                                                                                                                                  SHA512

                                                                                                                                                  4c88a5e211a78f344fd17f5560174e7aa7bbcfb0421308d7b2032a482e8349a0bbe0de009b3275333cd5da4b5005ffcbd6de3fff0eb8037305e3af913b7fe13a

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  384bc083e173ce14cace852af8c3213d

                                                                                                                                                  SHA1

                                                                                                                                                  ee3153e3f106595b9a6951475838a1ae94bc9ca7

                                                                                                                                                  SHA256

                                                                                                                                                  614e40f4310e5e23e0e99d316cdaa10ec78c2b30e21483d001356918020f8fdc

                                                                                                                                                  SHA512

                                                                                                                                                  79dff9c6fd3074950d5010d95d1d2be41738bf980d36c23ccc1948236d674a26bf92c8db27e90344b9a440addcbfeac667e1bd6b22a7f75619e98a12541bd89d

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  f4967d1e4a52ca670bd5b3ec1949c546

                                                                                                                                                  SHA1

                                                                                                                                                  fb309c650c235ace547e9fea0f7069f082da99a0

                                                                                                                                                  SHA256

                                                                                                                                                  c31dc3cdc0de2670c138e08310bdb237903100de130b973462273929ae82504e

                                                                                                                                                  SHA512

                                                                                                                                                  74d290111b5913b530ea0e5170dbf52d65d3a3ee39d0f62cdac5cee289d5f3f70373aeee047c01fd5bb4215d20b6d4bb76901c202238a9595709b3bb4a6e3b68

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  897ec5a6fe9edb2c0037983cc014320e

                                                                                                                                                  SHA1

                                                                                                                                                  9d758dafcf8f6fce98ad268af56af79ebc58eaca

                                                                                                                                                  SHA256

                                                                                                                                                  e6fa5ed8769228b208081f414ed12431fad8d74d302b2a8cca1453801354110c

                                                                                                                                                  SHA512

                                                                                                                                                  7cfb42f4670868070edf345467721a65b300ff808f7956964cda6a0fb19dbe8dc5f2e41169fa8f2292e75e63ad6699855ebdc0d800995efa3ce5125898e31040

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  7b1365a92e3ef21a704853c5186eb592

                                                                                                                                                  SHA1

                                                                                                                                                  29188cf5204cf812203c2f78635ae36f6f7b6f3c

                                                                                                                                                  SHA256

                                                                                                                                                  04b7a2af96600658d40e790c8ab6052c9aa8c25eaed61814f8793439d84f84a5

                                                                                                                                                  SHA512

                                                                                                                                                  a0355e179c3087ccf768e5a0d402f22c93e2504da1080d3f1e61408a5cf10ffec1c32a53f416889b1a89ed41b3adb942336e6de904af018c478f2f791bc0bcbe

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata

                                                                                                                                                  Filesize

                                                                                                                                                  7KB

                                                                                                                                                  MD5

                                                                                                                                                  293ba0b626a4e0e5f29669eaa9be815c

                                                                                                                                                  SHA1

                                                                                                                                                  5daef86c4d1c0e4404f21e243f21bcf19fad7f5c

                                                                                                                                                  SHA256

                                                                                                                                                  3fc11c76acde34e919feae2c7a300e3342fd5178e840499878689be475d71490

                                                                                                                                                  SHA512

                                                                                                                                                  d241e7fd5806a5841631b6bbe0270ce16de4b30b28fa79a7d9c905057b255ddfb7b66e4ac5e66925ea35bc12f8a0b6fdb1209f6700adbbff66cd573da9d7fbc4

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  236871dff13e87d1dc2e13786517f15c

                                                                                                                                                  SHA1

                                                                                                                                                  5051c63a24f9c21f0296583208c48ed087f549f6

                                                                                                                                                  SHA256

                                                                                                                                                  0b3edc94001565768c699cb5b942665a329ae1be6b8c9b18c1ce6a73b8314148

                                                                                                                                                  SHA512

                                                                                                                                                  b310508a1b24e24ae5e179ba76c904dc7be73ff95990eb16fd833588e6ac0709bdae21ea01677d8c42da25f1f725659f806f55839f0228d77f94d1ce7339bcc7

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  c4ff8b4fe245de28c94054a28f3480f9

                                                                                                                                                  SHA1

                                                                                                                                                  483f8d51a6d1473ce7682608bd91af82ac133d22

                                                                                                                                                  SHA256

                                                                                                                                                  b95211782226daf9241036c142b17eac778a1e6bc2c33f98efff440ce3b095f2

                                                                                                                                                  SHA512

                                                                                                                                                  16b984678eb9bd01c8a8b076df0b332711f0b90aeb485b3f60f4ebc8dadc43e04d8c59099dbbcf31f2432ceab0838a0fa87dca8039e1fd7ef01db93271c65fd6

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  88f285fd26ec9726bf47a6c519502945

                                                                                                                                                  SHA1

                                                                                                                                                  73c58be74e509551ec368db9c713348928fd46dc

                                                                                                                                                  SHA256

                                                                                                                                                  033ad9b6f226c970f96845fc0ec73e6f0957d94e10b809ce4e138428a95e43fc

                                                                                                                                                  SHA512

                                                                                                                                                  0e68c8b56ee86b6b78225d76ceed9c555b2bf0ae417299693a2c277b0659eee2b8e18ec0fe63f3fe45fca05fbb9b49e8e77376f12d9ebafdb498809ceecdf00b

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata

                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  231651704088f98e1df57622c699cc7c

                                                                                                                                                  SHA1

                                                                                                                                                  44d42e942befab28f5bcf0163500f3c47185ef74

                                                                                                                                                  SHA256

                                                                                                                                                  dd7b62c58711c1f60f3f3bce07ec28fcd45f032d8348251deae55035a6093520

                                                                                                                                                  SHA512

                                                                                                                                                  ded33bcdb371acba8f58a0ef72d69e7532eadc0519340b80125bd99d65837582a6209a6744dcf0ce21c25f6fe7185fee06587d263fa61024bc7387ef80d88924

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata

                                                                                                                                                  Filesize

                                                                                                                                                  7KB

                                                                                                                                                  MD5

                                                                                                                                                  9a6d939c2ec12c4bac67a7abaafb8fd9

                                                                                                                                                  SHA1

                                                                                                                                                  dec5fa0be3142b2c6be61bf7de159d52da5bf9d0

                                                                                                                                                  SHA256

                                                                                                                                                  ddf6d635eac4ca01c58a21e1b6cd14269ef0cc338693231c09e85a9f58b1e4fe

                                                                                                                                                  SHA512

                                                                                                                                                  9964a12918871b9ed41302d0c0b6118e53fd2ba7fc554456aca20af862ae912939bbd35f9746e2a20eb1fac3fc0391a041ff92268603ce126f95bd4d705d2ee9

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata

                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  82839b6a95a7ff768be54f353fba39a5

                                                                                                                                                  SHA1

                                                                                                                                                  e1568b2687223eda188c9f12d4cab9d5656c9ad5

                                                                                                                                                  SHA256

                                                                                                                                                  f95ea2235576f676804fe93d26d106d564c1bfd3b2bdea39bb8aa1c1f30fc5e8

                                                                                                                                                  SHA512

                                                                                                                                                  6f1b2e028eebc76bfbd6e33960a7d4ffe53ba151105c6ed6f31b3b8ddff0670cca82eeff819c42dfaa7b35d76b63f62136c787952a0cc45786ec22f5a83d3267

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata~RFe5a546b.TMP

                                                                                                                                                  Filesize

                                                                                                                                                  590B

                                                                                                                                                  MD5

                                                                                                                                                  27a7002f2037d59967af75f2d24fd751

                                                                                                                                                  SHA1

                                                                                                                                                  27e65d85c6af3eeb8887a79872950e866c3f97f7

                                                                                                                                                  SHA256

                                                                                                                                                  748f11ea0375d079140bdf2d74193123c677322693877a319a53bdc537102755

                                                                                                                                                  SHA512

                                                                                                                                                  9a243239b4d275c612d418f0f580595c69826441772cfd1d3b2b70a7e3de249237e4265d51f9748f5914bcb25291487ebd628428f7a58c53724b4cfec689c873

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  157bfe9acfa5c972b5b252183990d120

                                                                                                                                                  SHA1

                                                                                                                                                  3b5f6aeda07df6790b30f24e2f99433c954543fb

                                                                                                                                                  SHA256

                                                                                                                                                  cf97073179217d5b942c1e01ae923ab6fb4dff8dc18a3be9c095c60eb628b750

                                                                                                                                                  SHA512

                                                                                                                                                  f17af118238d26209d4a12901cb4fe624340db1853ca5ae46863a00f11c340e29fd5d66f0a27f9f3adeb9c9db3c78d194cb353b5aa3c1c2416cdc46ff98a2958

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State

                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  c85f4f78c33e3cc76d3df025a2020945

                                                                                                                                                  SHA1

                                                                                                                                                  b5b4581e03e5f9c6a5eb85a905ed00eeb02d06ea

                                                                                                                                                  SHA256

                                                                                                                                                  b15b9261fbf307038efa76293d8871942c5ea6576f37eeb3c99e3b138b46486d

                                                                                                                                                  SHA512

                                                                                                                                                  6f8ff5c1b4fef7c918629593b49255334e8944b339c1a41f6fe6ac26b8610a27bc80c5bfee125008625b93c4601e311b085e9e057abd865f2e3e7607865bac6c

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  ffd2c83ed86ff683a689141ae0dd1dd4

                                                                                                                                                  SHA1

                                                                                                                                                  6655a08db2b83b5c591d41809389711e38cb011e

                                                                                                                                                  SHA256

                                                                                                                                                  2c371bbaef959753a406a57ea7db9412e6bc9a510521a4ad62e5de24187a6774

                                                                                                                                                  SHA512

                                                                                                                                                  8f64ed2a72d3e384dd42f5e24fd3968a6bb0916c0156a2864b84112dd246c655cc75e7044e9f5f3b2e3380b1ea62befc4ddd361ca261353dd1cefe3b7920889c

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  0576d2fb0bd09cb88f4bb0fc5034d4ae

                                                                                                                                                  SHA1

                                                                                                                                                  7408092773e9f989bb04b9d13cfeba7afc7604da

                                                                                                                                                  SHA256

                                                                                                                                                  15a20f7a547a968bb0672799adfcb350bdc2393cfcec7c6e2f25c84ff839bce6

                                                                                                                                                  SHA512

                                                                                                                                                  e02feb2694539e5a153baab32819af96ed7772476fa6af6d2ddb0e50f1f58bbd1e0aaa91daab77f9bc9e84153f9b67562cd98e1002b05c0af6886310954871e1

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State~RFe59f449.TMP

                                                                                                                                                  Filesize

                                                                                                                                                  59B

                                                                                                                                                  MD5

                                                                                                                                                  2800881c775077e1c4b6e06bf4676de4

                                                                                                                                                  SHA1

                                                                                                                                                  2873631068c8b3b9495638c865915be822442c8b

                                                                                                                                                  SHA256

                                                                                                                                                  226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                                                                                                                  SHA512

                                                                                                                                                  e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  fefdfb70b192f734cfe206d2f8e1d9da

                                                                                                                                                  SHA1

                                                                                                                                                  5f0b83dede2f869d52c658c90057a8164b23a7d5

                                                                                                                                                  SHA256

                                                                                                                                                  f450419233ae8eda28d08f9e48d3d374fddc9577fcc20b3e64efc3f4c38eedf3

                                                                                                                                                  SHA512

                                                                                                                                                  90d97db138d3802ae347b73bdd2638d7b84a7f1944124716b18882d27308f1194a6270901b131d50e1d8de5aedcf97e83e983c014540a3c2ef2eac49c7a40038

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  dab289ed21eec76fce05f358d690b1e3

                                                                                                                                                  SHA1

                                                                                                                                                  e376582a5c632077c04b2c6bd7b235c85c1ecc8b

                                                                                                                                                  SHA256

                                                                                                                                                  aa5c1ccb166553de6894f34de84bcbb7599facbfeb621ab7004189b0a1ab725b

                                                                                                                                                  SHA512

                                                                                                                                                  88a0d79fed6d4e1c3753362fddf0a54ef06ab3825bbb9cd7775016001beeaf93e86fbc2a4790650f1e316244129ad51579aa65b10d0ad88aa81324c44c08b422

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  1b7a8dfff213390f7d0ae1e99df86473

                                                                                                                                                  SHA1

                                                                                                                                                  8b1090e94737caa36cce3c1311415e1ceab2c041

                                                                                                                                                  SHA256

                                                                                                                                                  5400d0656edecd4c40f8c9396fb3e31aa3f478ac03babaf0786a9fa261e889d3

                                                                                                                                                  SHA512

                                                                                                                                                  e3438757ba452eb141e1ef6aafc1e8de7f0fe263748affd9728d3e32d10b30cc3735b62d10da519fc67a5399dbd22ea0cdfc0fc37ff4c4cb32e12c3ca7a660de

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  522B

                                                                                                                                                  MD5

                                                                                                                                                  770c3564df8b77faabf7b77136522636

                                                                                                                                                  SHA1

                                                                                                                                                  3f70dd60b6bfae310186372d29ecc9790acc4a54

                                                                                                                                                  SHA256

                                                                                                                                                  4d8ded0d1d28bfc3d6ba63740eda1d79ac5204ee09a892ce43949bebd7a11991

                                                                                                                                                  SHA512

                                                                                                                                                  dae9f6d275e7855e0dae594896b943837916f34115b918b7080d0f2de680b7fc678a973650af2eb5deb3ce09b2a3462a3203b1fb56a55d980eb8f0fb99b4c03c

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  9f2820af48762b0cf553e5e819e0750b

                                                                                                                                                  SHA1

                                                                                                                                                  e363dc7820431d7b96419b09901a58de79a6421b

                                                                                                                                                  SHA256

                                                                                                                                                  803ab457e01f69a6f6401658c70f80d9145880a85dabd474c518a02616664934

                                                                                                                                                  SHA512

                                                                                                                                                  97818d6b69396f221548d599055cb4007f4cb23acc0a57b17b9412a40b53f1232b9eb82b96080affa13e56c7b5152bc18a3f17de6dd1e843c1fc4dd24da19b60

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  8bcf93e559c3ebd10654505d9107d17a

                                                                                                                                                  SHA1

                                                                                                                                                  f66d6b67d47a694500f4a8b08fde653072fb821f

                                                                                                                                                  SHA256

                                                                                                                                                  cdb05cde0c0dddf50f567ca3745db33c0f40d173a67460c1f07062a6b57c3ef8

                                                                                                                                                  SHA512

                                                                                                                                                  952624ba93aa4da95b89f3bb1b8b1f999a2926e9c7a4c6c199c5ed07ee73eab15116c1d41a1c4d44e1b5e7bba084b0e7896beb32f2cc3165b5757e82043ce9af

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  6a9a35de7dc56a627ec8fba0a28546f0

                                                                                                                                                  SHA1

                                                                                                                                                  874bf9371b716446b31d416e6fe0a9271b3b85cc

                                                                                                                                                  SHA256

                                                                                                                                                  a2ff6c3826a4ca79023ede8d26c4a01a1f270ee39699f2afad02079634c81e38

                                                                                                                                                  SHA512

                                                                                                                                                  300530a49161293a1462ebe9a0846625a3b89bdbb106bf83122edbce5567d6f760c3899f0fe20a4123d6fb8569f6cb1bf7158190b8df89297a84f56bb93bfa97

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  857B

                                                                                                                                                  MD5

                                                                                                                                                  fe7d61fe0ec83832e80dd4acc51882fa

                                                                                                                                                  SHA1

                                                                                                                                                  c2280114fc964316b7c1a00d8cb1279e13106cb0

                                                                                                                                                  SHA256

                                                                                                                                                  82e2434d4d4fa833649bcea06c22aa0e3b405f531aa79645b3c7d4c704703972

                                                                                                                                                  SHA512

                                                                                                                                                  3081f6a7399a580863340117e4911c3531d491f92b71659b9ecda69ad8f6359b67fb5d970f363ef158d55351b0166c25fb463e136d8d0132f32b0e73a56be6c2

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  78271425e9e43b53fb43f6385f83fddd

                                                                                                                                                  SHA1

                                                                                                                                                  fa1e9b71205a4905b5ca3eb4930427057453fcaf

                                                                                                                                                  SHA256

                                                                                                                                                  11614bace088a6cc7905264dfc9960775e4781e97119e1e0a2392d1c7c28a073

                                                                                                                                                  SHA512

                                                                                                                                                  2b8c94227f5dfa5b749a67d0eb0a851312e7438dad2f5751cfddc0af1de4813ed9479d8cffc0a6bf545690b6dc5069097c5fa5bfad07674050b8fadd32aa3c47

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  2a9133baafd525d0b7a25baaf85d14c1

                                                                                                                                                  SHA1

                                                                                                                                                  0c7506b429c87eb2e5bc536f8d83749630873eaa

                                                                                                                                                  SHA256

                                                                                                                                                  04b9b689a1a54711d6b00d7cfd9b906f41ea64bf73b5c95dc639d307aeceae03

                                                                                                                                                  SHA512

                                                                                                                                                  d95fedd6aeea3eade5924fe84fa044ef2266924ea292cb9d22730d5c09a97c24fa79a24895cb74752c610ef935f43dbfba11748f92fd7c531153099bd37d2b42

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity~RFe594c70.TMP

                                                                                                                                                  Filesize

                                                                                                                                                  522B

                                                                                                                                                  MD5

                                                                                                                                                  1e35a4cc18472c9b7832aef23d6b0ee4

                                                                                                                                                  SHA1

                                                                                                                                                  69c14ce0cd332c16d540c3f21a0690ab0f6f8d8d

                                                                                                                                                  SHA256

                                                                                                                                                  8cd044daa4d1e21782ec5e1bf9cbdca52581b6202b74fbbba069da36baf42ea1

                                                                                                                                                  SHA512

                                                                                                                                                  ae8c902cd7e50906a5de8298c21173047ec850143fba261f2fe499fb29392aafad56fbed85f4c124f15926d835289f1665b6b6c17049a0c10badb28854d9b0c0

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences

                                                                                                                                                  Filesize

                                                                                                                                                  21KB

                                                                                                                                                  MD5

                                                                                                                                                  65ffae23b715e8d4a38736df6034d953

                                                                                                                                                  SHA1

                                                                                                                                                  84d509e501dc3a4984632f99d7a7b44aadfb9509

                                                                                                                                                  SHA256

                                                                                                                                                  90f81b3c216b2210383f849161c53e5f4f71438d5b7cc068bd801aa5395ba2c4

                                                                                                                                                  SHA512

                                                                                                                                                  e04b27e45389f36eb8865d94903fd19cc58bf56e926c6f4b5619f7ebc70794816070faed19d1f14c436cccb41c72bb625022b96512d789221d88c1347452014f

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences

                                                                                                                                                  Filesize

                                                                                                                                                  17KB

                                                                                                                                                  MD5

                                                                                                                                                  b11591aba0133935942c102c42f7e8ea

                                                                                                                                                  SHA1

                                                                                                                                                  5d6a361a71debbb298396374b227c5b038afaf7e

                                                                                                                                                  SHA256

                                                                                                                                                  d40504882c18c23775015cb5da863c853af66fcbf5bc2a55c8da9582577df13a

                                                                                                                                                  SHA512

                                                                                                                                                  ace217adec9deaea6b793a6c9664d2a56e364b111a527f3714c2af94af43f46d047a2aae94323856c947c6d6523ddebfb97ab8f417432336022f1bf218171e67

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences

                                                                                                                                                  Filesize

                                                                                                                                                  17KB

                                                                                                                                                  MD5

                                                                                                                                                  05263a06ff3a27ed04b2161e28d2b3f1

                                                                                                                                                  SHA1

                                                                                                                                                  b3d05f7db2eff9e8ac2c45a8dade14a63f77262d

                                                                                                                                                  SHA256

                                                                                                                                                  c6e7109d3c60f7a1da9bdca884a3678b468ec47d28574205a1999082d93cfeb5

                                                                                                                                                  SHA512

                                                                                                                                                  fa8ee29b55662d34531e8249fc6038a19fd6ff14df7941b27127e167433148df7b041744c0217c879353b0ba9df3ea19504af95f8d8dd4ca9cefc9a5a0199ccf

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences~RFe58f97e.TMP

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  569d4458cc420661ea0e2b021e705c9e

                                                                                                                                                  SHA1

                                                                                                                                                  70798ad4e4aa3dc83ce3c8c5b3f69cdb2bfb4916

                                                                                                                                                  SHA256

                                                                                                                                                  d94ca26a1c4dd84d4883e532ffee9ecd9eb9385fff5285623d53a7b07afda49a

                                                                                                                                                  SHA512

                                                                                                                                                  98741319592a6b09ce1844fae58fd3b6e7abb755b71acf073fa4d994f38360a903e49294e31ca03f3ff4edd22a84825bf5bca334012986da9efa1f34b99f7138

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Shared Dictionary\cache\index

                                                                                                                                                  Filesize

                                                                                                                                                  24B

                                                                                                                                                  MD5

                                                                                                                                                  54cb446f628b2ea4a5bce5769910512e

                                                                                                                                                  SHA1

                                                                                                                                                  c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                                                                                                                                  SHA256

                                                                                                                                                  fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                                                                                                                                  SHA512

                                                                                                                                                  8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\FileTypePolicies\67\download_file_types.pb

                                                                                                                                                  Filesize

                                                                                                                                                  7KB

                                                                                                                                                  MD5

                                                                                                                                                  d28b6246cba1d78930d98b7b943d4fc0

                                                                                                                                                  SHA1

                                                                                                                                                  4936ebc7dbe0c2875046cac3a4dcaa35a7434740

                                                                                                                                                  SHA256

                                                                                                                                                  239557f40c6f3a18673d220534b1a34289021142dc9ba0d438a3a678333a0ec6

                                                                                                                                                  SHA512

                                                                                                                                                  b8dbebe85e6d720c36dbdae9395fb633fb7028fecc5292498ac89276ae87bd6de36288fbf858f3476e18033a430f503acf6280596449dd0478b6ab7139f3cea6

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_0

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  cf89d16bb9107c631daabf0c0ee58efb

                                                                                                                                                  SHA1

                                                                                                                                                  3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                                                                                                                  SHA256

                                                                                                                                                  d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                                                                                                                  SHA512

                                                                                                                                                  8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_2

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  0962291d6d367570bee5454721c17e11

                                                                                                                                                  SHA1

                                                                                                                                                  59d10a893ef321a706a9255176761366115bedcb

                                                                                                                                                  SHA256

                                                                                                                                                  ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                                                                                                                  SHA512

                                                                                                                                                  f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\GrShaderCache\data_3

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  41876349cb12d6db992f1309f22df3f0

                                                                                                                                                  SHA1

                                                                                                                                                  5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                                                                                                                  SHA256

                                                                                                                                                  e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                                                                                                                  SHA512

                                                                                                                                                  e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  77KB

                                                                                                                                                  MD5

                                                                                                                                                  fa0ff8f117069cb14346590867fd2896

                                                                                                                                                  SHA1

                                                                                                                                                  74b9c9f79c8f0b515a77513758e8513f3f9db609

                                                                                                                                                  SHA256

                                                                                                                                                  c91430aec0e35ecd71f21da25eba3e978018e96d92316e82ffdb0234ad5de939

                                                                                                                                                  SHA512

                                                                                                                                                  743ed77d4f0128416f8a8ae06797c45708daa45a02363292d8966ccb4ab15c2ea2fe3362400c78e6b5e36b98e1afad0d10af6d07f59e14e0136c6d02e56b2cd0

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  60KB

                                                                                                                                                  MD5

                                                                                                                                                  ca6c98618ca0a7349652c780b713f2f0

                                                                                                                                                  SHA1

                                                                                                                                                  8bd69cc6fdeab6ebd23e6013d479532652e7100b

                                                                                                                                                  SHA256

                                                                                                                                                  f0f265f66b729e38d5d5d616d61d989c518fcf231a2b5972e86b048c860f08c7

                                                                                                                                                  SHA512

                                                                                                                                                  1fe8af9ca4a84a5fd99dd2943e0ec1f78f6c47fe1b3519a0e8f056c7c52eb2bc9cabd6755a89f075f601c97bcb8a3facfcb75d98e12d6ee4df385e8f3c2d0392

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  MD5

                                                                                                                                                  69af8de76fbd8f61ce5a10b014079f8d

                                                                                                                                                  SHA1

                                                                                                                                                  6e4179f5e40825f750c1da996d2a041846feed33

                                                                                                                                                  SHA256

                                                                                                                                                  0ea786dabd95c0bb002b58e0c241c241a8367b4591437c12c51601dddde15f5b

                                                                                                                                                  SHA512

                                                                                                                                                  3390ae61045fe06a16d61a0f7ac62888d508546eb5a82aac8db2b4a1cb41a8878cb343914393df7a84d6a07ac18d940fe4aaae0da9f6ac99e088d1954aa6c3eb

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  67KB

                                                                                                                                                  MD5

                                                                                                                                                  41fad890c27e3695d65b4a1620567581

                                                                                                                                                  SHA1

                                                                                                                                                  5ec25da616bd93de2fec9d535920501f91b86d50

                                                                                                                                                  SHA256

                                                                                                                                                  569ee41217cf5d6b2c6d4fcfc2c0a66135eda2b2120840caa9b3d781d7aaf2b3

                                                                                                                                                  SHA512

                                                                                                                                                  ede202a643c44444da290b3531d60feef6d337cdcf197f882db2ea1fe9428cda08ff34ce1611c8dcc9cd5598f2a1eafbd7cc15b12b732a132564cc7c6d9f612d

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  68KB

                                                                                                                                                  MD5

                                                                                                                                                  802437d7a12f2f51f064356c3cf88b4e

                                                                                                                                                  SHA1

                                                                                                                                                  0127f8046a8287a3e3c841afd2bce595077cd036

                                                                                                                                                  SHA256

                                                                                                                                                  1c3de4b4c51fbac8eb5e36531f0c6f1f0c0fa636786b293e2759ba5608105e96

                                                                                                                                                  SHA512

                                                                                                                                                  83a33f44e270bd12f8fc7c95582d0482e43c86fba60690c1d7bdad431445b48d26c6316ea8627ea0ebd480eb2a75a3be789f5b907a5f3f6f9b3b8670d4757f46

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  71KB

                                                                                                                                                  MD5

                                                                                                                                                  cc01e560dcd063f2efccda254a7eeb55

                                                                                                                                                  SHA1

                                                                                                                                                  63c4561e7dca57e4c94f1798d3d00833913809c5

                                                                                                                                                  SHA256

                                                                                                                                                  7d23d1d42449f68a5e07ea92865699c4e71fde7c28d428c81afdf133fd6913a4

                                                                                                                                                  SHA512

                                                                                                                                                  4bac80ac12902e393970396a0ec36dab48193814961499ad7e0ec1c3813a5107bfd0d6b8b2dabf0c907b502938d869697c5744bc3207a71dfaf6855b8b75c5d3

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  71KB

                                                                                                                                                  MD5

                                                                                                                                                  aea5ae4292d3fe61d5f32946cf32369a

                                                                                                                                                  SHA1

                                                                                                                                                  b2fdfbea5d40d991c4b3dc334136db4f8fc8a282

                                                                                                                                                  SHA256

                                                                                                                                                  f800161200b766e3b94be48b6598eb5995c11791afddbf18f37922834d21ccb7

                                                                                                                                                  SHA512

                                                                                                                                                  4c8490bcb2455e0bbacf4d647be89baf8f4c1f7106872e917901025ab8ef5df5a0c8437e00c88176cdc9f58c965c3208f1ddcf4e9bec4d7de1a73e52e243f241

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  74KB

                                                                                                                                                  MD5

                                                                                                                                                  10a66a76cbfa8c09421319f44c9fb402

                                                                                                                                                  SHA1

                                                                                                                                                  2cb0637b891f692a5c0a3a2673d42d180cc5b65f

                                                                                                                                                  SHA256

                                                                                                                                                  4200ed05010c87bad10c8168bc08946139ffbf2c636793b9ddc63165d27bbc39

                                                                                                                                                  SHA512

                                                                                                                                                  e0fffabb2648270f58e02cab59689a00714ae70aed90eeb16b2ca6eaaeeb628e60e62734d3dd5777755f81c899bb2ff62c11fe63bce190de893381acdf35369a

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  75KB

                                                                                                                                                  MD5

                                                                                                                                                  a8de1772e077238042b2e09598bb71e5

                                                                                                                                                  SHA1

                                                                                                                                                  77094400af4229cefafe4dad585b01031c9ea0ec

                                                                                                                                                  SHA256

                                                                                                                                                  642d4804e6c23f399d6c5918f4d69154db97b32db31490b207587a6c25584e33

                                                                                                                                                  SHA512

                                                                                                                                                  b785de803455abecd66cfabfc39a1cbedc3fd4ac3a64b9ef96852684259032d81ca330621ab548543f2755b45d49e784c24b624637df3abe93e2ded005398a99

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  70KB

                                                                                                                                                  MD5

                                                                                                                                                  78a48f1d85032e408bfb13139c53b3a7

                                                                                                                                                  SHA1

                                                                                                                                                  ee89aceda3a39dfae3870045a8b40b906f119186

                                                                                                                                                  SHA256

                                                                                                                                                  2ce1b9ad657913b3b1344bc40f897bf108340ed2bee04ecc65802c8feff95529

                                                                                                                                                  SHA512

                                                                                                                                                  df4e631adba4cfb19c9aa21ee24aceefc9df2023f1c8123e3cdb43020cf8af240b7078cee385c43d1db25bf81a894922ca166fdd8fd239e630126bf24206c77c

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  74KB

                                                                                                                                                  MD5

                                                                                                                                                  2b39df71304989727e194daae1ae33ed

                                                                                                                                                  SHA1

                                                                                                                                                  85709467c236f42770f232fd56eee45dabd9aa73

                                                                                                                                                  SHA256

                                                                                                                                                  a97c30593a8cded9b73d65b809da1e6dbd1efe323c9407f92f88e4aa5f098437

                                                                                                                                                  SHA512

                                                                                                                                                  7cd9617c5689f99e58f0c1fa3c797ebcab77d50b6072ed1e843d0920b1a7ccad55ed3045bc77c3a93646ab4765822939016dc13822f7936ca8a32920b634ddd8

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  51KB

                                                                                                                                                  MD5

                                                                                                                                                  fd72407952b145991797823f0a9fd670

                                                                                                                                                  SHA1

                                                                                                                                                  0f6552ca2691b15acf45c103e27ea09c06690ca0

                                                                                                                                                  SHA256

                                                                                                                                                  8588ce16a6c2eb1309cdd8d4b3037cc56ee9d97915483939b66e579dd06270af

                                                                                                                                                  SHA512

                                                                                                                                                  f9ab7e4a1f0a41bde56511d4cc818f5e163d35d17328f46280efea08bcb2e7e02125fb114827b0f914285effbefe0f45dff7b7b1bade126ac516c17f16db11ab

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  54KB

                                                                                                                                                  MD5

                                                                                                                                                  9d7265ab8cb0d4cd9d94cc8acfcd9616

                                                                                                                                                  SHA1

                                                                                                                                                  2881ba8c35ab5d57b4ad6046a46d873488f9fb74

                                                                                                                                                  SHA256

                                                                                                                                                  0a138ed63fa89fb7255953ec89a96cbf426757949dd3c045e389cf24cf90182c

                                                                                                                                                  SHA512

                                                                                                                                                  8ec1460d45ff112c85f1c7e4c1d2f0a95dd3b8cc53fd2213191aaab593e9ecad2d4b5c53341c9a5573e1ea7dbccf9a9beeaa28fecfe5a0175e84262409212fd7

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  60KB

                                                                                                                                                  MD5

                                                                                                                                                  6ed634427d3751a5807b081fa3c78409

                                                                                                                                                  SHA1

                                                                                                                                                  36c68dd7bfa373f97c9552e1e1a7e19744285bb0

                                                                                                                                                  SHA256

                                                                                                                                                  432eb3eaf4e5d67a02fdaa7bf9054ddf59d47101d4b9b04a70a5c66fc8455928

                                                                                                                                                  SHA512

                                                                                                                                                  1f71ef0a0b19819ee118a5bce0f5866aca6490276bd2de1598fc4bf57f9a503706997dd3fee8d2d793ab5e17adae852a4c2fb97a24ae92262f6e3d049ae20de8

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  57KB

                                                                                                                                                  MD5

                                                                                                                                                  dc24aa143631d42d1b4ca326ccbd80c2

                                                                                                                                                  SHA1

                                                                                                                                                  a92716f28556efd8b77d7c5e62d5e97a3c1ad4db

                                                                                                                                                  SHA256

                                                                                                                                                  88327a637cea34d47f673a9d54d5b70e31b86c0d1b32bad3d7deb7500c6b796f

                                                                                                                                                  SHA512

                                                                                                                                                  e8922d195e6bbd3fe45918e61fc15adce0b6d4b133229f5e9749c3f89dfaad8e5e16d30c1f7a5cd93ab0ccd58ac1a4ade00fa95b92b1ef44d0a307893ea707d1

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  61KB

                                                                                                                                                  MD5

                                                                                                                                                  0cdc363d0424f6edcaa1ee5fb54c72d5

                                                                                                                                                  SHA1

                                                                                                                                                  76423c51163645022dbfcd9f7fe985f3485d398c

                                                                                                                                                  SHA256

                                                                                                                                                  639c8808c6321904c622c362d2d321d8a8ecf25e80af53e2e0f57b79f6d81cf6

                                                                                                                                                  SHA512

                                                                                                                                                  22381a6ed1b646a4b9fe80a425c05a47bcdc808b1fa1df0815b7c60e5040115e5292ed82e4277d19f18f2d9373bc7731ac51f74a76e53c1701a7e02bd752abc6

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  75KB

                                                                                                                                                  MD5

                                                                                                                                                  aba9a1d52ee21a2a4f22ff8c09e81c91

                                                                                                                                                  SHA1

                                                                                                                                                  3027add1920e1c3f4947d30c1202a005283c4af4

                                                                                                                                                  SHA256

                                                                                                                                                  67d7d59fdb6bfb4f9b07e1a8e01da535921ad347a9851b87394643ddf047e180

                                                                                                                                                  SHA512

                                                                                                                                                  b1501f3116b41984538dad92136cf1b9faed063b3a51c80a43741a824caf2f28db9a082eb089d6cd4812e4dedf9231f1a5d41917a958b1684382bc9e0e583a7f

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  76b7ca2a0e712e5abf519bd8380b1f49

                                                                                                                                                  SHA1

                                                                                                                                                  fc49391c23e30eed55bb3893da2b423929b7b47c

                                                                                                                                                  SHA256

                                                                                                                                                  b759c588571e20c3c7e6f54c8a1923719ac36eb81357a4fe4f6bfe85aa4e1acf

                                                                                                                                                  SHA512

                                                                                                                                                  07ac7e90b1a8bffb66c8ce4ef7c078d5e759bea93e0c4438b3248cb71674eecf1f620fae87ae3ce1755b8a4fff7d09fc82df0c3e5947ad0223bd162c6ea4d377

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  51KB

                                                                                                                                                  MD5

                                                                                                                                                  9f01a61a1fb4dae3ee98c3142b9ad335

                                                                                                                                                  SHA1

                                                                                                                                                  93a20dc637541a59fe5e4e04a3288cd5de7b8176

                                                                                                                                                  SHA256

                                                                                                                                                  7cd544d045dced9f29f41bcf9225622a42e2537281fff1873acfd782153bb629

                                                                                                                                                  SHA512

                                                                                                                                                  f783ff3e0f7cd85ed75fe3897e5b4439e08ab841674e4ba50de3ebfbfca847e80494e921da0570803fc144fb7c047087cfe8409b373443e63caaa3b236a88961

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  51KB

                                                                                                                                                  MD5

                                                                                                                                                  b39bc9f3ed5576155ed8e25bc7692496

                                                                                                                                                  SHA1

                                                                                                                                                  48961be5f9cdb2891ba02621e17a4a1a3fab0e80

                                                                                                                                                  SHA256

                                                                                                                                                  e00cfb599e06a117224b32164621b486c64666cf11bcbd33ac6b5d8346abbd18

                                                                                                                                                  SHA512

                                                                                                                                                  afd2782968ad279c2cdb0802534e1d2fb83f2e49a2e97953c83655d17d7e9afbdff1dd1ea66c70d3418361bf06d6af8a7f06ce5298909f10dd13feb18a41d20a

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  54KB

                                                                                                                                                  MD5

                                                                                                                                                  74479290e80c9b2b32b64b592a9c60b7

                                                                                                                                                  SHA1

                                                                                                                                                  ede6732898af208d627f800063b10ae1bae46cda

                                                                                                                                                  SHA256

                                                                                                                                                  7af37d3b845ee39f2ca0e314b9b324e675e772eb94afb9e2684b40d0369ca504

                                                                                                                                                  SHA512

                                                                                                                                                  05e0ab0864d638b36be5fe7b95ed0e6cbcbdc1a63657c04b95f4e42c22246c550535971f45cbf151c71e4c097591b845893b8acddf629e5933b695bc3a68b0db

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  57KB

                                                                                                                                                  MD5

                                                                                                                                                  520032bb904cabb05a409d17170ccd65

                                                                                                                                                  SHA1

                                                                                                                                                  cc084a02e320dc49a09f03f34b623f747ee40b8e

                                                                                                                                                  SHA256

                                                                                                                                                  64523dd8860d6d57e824f810d8738ca5ecb6463e7e5c79289807aa65d29b7865

                                                                                                                                                  SHA512

                                                                                                                                                  21e1e3a3de2d5e4c929920d512adab469756621551268b294c447d45fe3f12f74f5b5fbe157b70980b18f32624c4b1c1e92cd3710fedef19472adb89bb098a31

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  67KB

                                                                                                                                                  MD5

                                                                                                                                                  8b191c9625c38ca050d8ac0228ec6fb9

                                                                                                                                                  SHA1

                                                                                                                                                  42055de3e8d203bbd83871b16c5270dad8547c54

                                                                                                                                                  SHA256

                                                                                                                                                  0d78e473a2bc41393501fd2ff6240e68e4ece2968f5703124c767e6e7956ecb0

                                                                                                                                                  SHA512

                                                                                                                                                  c6537ec0e6d3706cd386750e573ed3a3b16b720570c0ab29481057d5c96a44dd3e5ab8a8b3e5b5be2bdeb497ffbe9895686936f5afd27cc1e84395e4def08cd4

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  77KB

                                                                                                                                                  MD5

                                                                                                                                                  b90134e80be6f6104721a7daa73cec77

                                                                                                                                                  SHA1

                                                                                                                                                  cd017af0f0aa564725bac82758352d8134c6bf79

                                                                                                                                                  SHA256

                                                                                                                                                  e75e79eafb67795855267eecf755ea3478d66123f2ebf1b931cb1c3fff25f8a2

                                                                                                                                                  SHA512

                                                                                                                                                  c311b0433229061a43b6747ef8f735c8e898c1a19e5eb37039dc1ec6bde5c26fb71895f3f5ad776343c969c033d78b6dee0598847aa0993ae6afa7b8b896b57c

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  71KB

                                                                                                                                                  MD5

                                                                                                                                                  f4e92aee3c138bc1849cfa7c21a5a9ff

                                                                                                                                                  SHA1

                                                                                                                                                  e73590cf4d7cd3bf343dc0b4fc78745895c678d1

                                                                                                                                                  SHA256

                                                                                                                                                  4e5c06e3ed7621c3ae282417e1569e6d98a758f27837ad47e523cb9cec395d10

                                                                                                                                                  SHA512

                                                                                                                                                  c896b2539690c008320f530696052546c084268182108f061fe3abee81f0376c24b9771d00a09f366a2c6c27d2f9030b9a81c24c5d7618563d940e2c7edfa360

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  75KB

                                                                                                                                                  MD5

                                                                                                                                                  df390d5db1d27b3dcfc35f518c30aace

                                                                                                                                                  SHA1

                                                                                                                                                  de5ac3d89481e1987222cdbc9eef8b00a2f1dea7

                                                                                                                                                  SHA256

                                                                                                                                                  39033a331859b6390506f000417d274aa959165accfbaab21d508dc6db6b54d5

                                                                                                                                                  SHA512

                                                                                                                                                  6d771d79b161bd9667cc3db2796c29206d8fe1710ac6b3056a2b8108eb82d73351039e161ff28be83b43a6b578d375da43e0a85af2252bd1d43bc08c042faddc

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  74KB

                                                                                                                                                  MD5

                                                                                                                                                  c3db5e21c2498a91efeb01ef4e2a2c94

                                                                                                                                                  SHA1

                                                                                                                                                  63aa5e9ecdeedeefe65cb551d85d72c105c34b68

                                                                                                                                                  SHA256

                                                                                                                                                  a1c53aa09955f32aec9d60f79cd4b61eeb7794f910055f017ae74b3c06d8f24b

                                                                                                                                                  SHA512

                                                                                                                                                  2c2ca4f4d0f3a8daa4c086dbc7e129129402ed6a160f702422fcee01bcf38f2dd99a74459395ccb3e83584557dd4357fc385e7840edc3aab8cbe5ce10cecf5d4

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  51KB

                                                                                                                                                  MD5

                                                                                                                                                  076c029ca0b3e68dd58b7e1197e08162

                                                                                                                                                  SHA1

                                                                                                                                                  a20e94d0d148bc59daf7798fc187465b097d32b1

                                                                                                                                                  SHA256

                                                                                                                                                  2f4b518012758242b0704ff3da3fa3a0d74388c84be69737d01daece2725a524

                                                                                                                                                  SHA512

                                                                                                                                                  362b6f7e5ffd16f120493f4ee9383670943fce8bf48b0a72c2aba96dcb7a3897ed455f1c34004af595abb4ee25c89b61e7cabb2e3b62ae4c7e76d70687fb746b

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  60KB

                                                                                                                                                  MD5

                                                                                                                                                  29516191c5235d853ec022380c7ed6de

                                                                                                                                                  SHA1

                                                                                                                                                  5f60645fc19d1d61a50b9483b22d6436a00bfdc8

                                                                                                                                                  SHA256

                                                                                                                                                  3b734ecc96731ac931c52d11f92952bc01145438743df57fa8bb5876f46697d6

                                                                                                                                                  SHA512

                                                                                                                                                  8a2ae50447dee5f4cc04507fa5dc1a51dd235654c72183ff0edd3e2c7111617660409e287d42b300326c0b1c21ac9845380bc86ac328ef8ee0612ca184bf0e2f

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  67KB

                                                                                                                                                  MD5

                                                                                                                                                  c87a5d6f5205842032dd2f0af2f2217d

                                                                                                                                                  SHA1

                                                                                                                                                  b76db83094ccd635f54f7c9866c9f106842060de

                                                                                                                                                  SHA256

                                                                                                                                                  ba35026ad26a9f67a050b88416abbec971540ea0b40bdfaeae13921779b874e1

                                                                                                                                                  SHA512

                                                                                                                                                  68942162532429108188c77e0e72fa31c49c9b2ed02cd98a8657a70ed7589a10ea370671085c251010ffa8318b1d38d79f067dfe95b72251d6316daa81d8cc78

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  68KB

                                                                                                                                                  MD5

                                                                                                                                                  8ad8444eb46fc9db5ddddbf6ca5e7428

                                                                                                                                                  SHA1

                                                                                                                                                  5fe7fe3c1c4d3a2d2f81e370533c90fdba7fe1cd

                                                                                                                                                  SHA256

                                                                                                                                                  a3ce186422570a332aa41af2b36465105767d8add7e6f758a21f4be27dab2067

                                                                                                                                                  SHA512

                                                                                                                                                  468de1277d270980efe3ff1ae8ac2a0d340ac4cf78cb0eb0234c3d2c5d0de8fb1e32c44e13bec111ff7030924cdbea4322e2146853c54306700ac57e629d66a7

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  57KB

                                                                                                                                                  MD5

                                                                                                                                                  5a85305bf7350dcb3673a76ef0ade2fd

                                                                                                                                                  SHA1

                                                                                                                                                  e991d2293368553b35535e323a40c59d74df7ebc

                                                                                                                                                  SHA256

                                                                                                                                                  0ec224c78496f8271c26b3fe18beca00ac51e2b752383a405fc5f2717e7d5a2b

                                                                                                                                                  SHA512

                                                                                                                                                  97ca92619704e6889ddab465064794bf5faef0f9fca31130c6252f8a75f87d137f7e9523879b482cbfb22229311e505851355d7aebde3145f18b0f7b538946bc

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  70KB

                                                                                                                                                  MD5

                                                                                                                                                  97e9a694ef8d654b96afffa7f5f00823

                                                                                                                                                  SHA1

                                                                                                                                                  388c3759b7dc16251a654454c23ff6ad8e11021d

                                                                                                                                                  SHA256

                                                                                                                                                  fda4890c21499ea1bd5a26c4b6b97a4eed99f327875cc9168ac2479db675e95d

                                                                                                                                                  SHA512

                                                                                                                                                  cde3fcdf401f1680202cef491f897bb3d28355b6999b391157a94807e20e973891646d275ea262d4614bd16fbc7c0cc88f47835ea7c0d316a0b808e9305b32f2

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  68KB

                                                                                                                                                  MD5

                                                                                                                                                  8ca5dda422efa7e39c9ebc7b64881686

                                                                                                                                                  SHA1

                                                                                                                                                  30dba9ba843067827635442349ac71b3c7594ab4

                                                                                                                                                  SHA256

                                                                                                                                                  f406e2c73589353eea644d1b2968579186134eac35bc9a4cd6662266e4774dda

                                                                                                                                                  SHA512

                                                                                                                                                  c823fe5f46f5d98f563c63b8bf1eccd2cbc08e66904492d105e8788ff9b594436f26f6db5654293d629c2390d14680c5f653ae427918458f608b62a30aeb9e22

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  71KB

                                                                                                                                                  MD5

                                                                                                                                                  5ad42e7c11bde7cddc74d05d8ae296eb

                                                                                                                                                  SHA1

                                                                                                                                                  572e3836dd63839292ef4154d3c08bd839d862a3

                                                                                                                                                  SHA256

                                                                                                                                                  b54ae3c9672428dc101bc9016ed8e1f456f56f1e5ed3b3029aff899417fc5071

                                                                                                                                                  SHA512

                                                                                                                                                  2a24c13ca82b9817be59e5c3800420c1800b0c3c1e0e4065c64137ef148fd1e515ffa565206cc10c590da6e0569fd1ae4784d1d9a6dc15d7e0e4521702dc3b36

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  61KB

                                                                                                                                                  MD5

                                                                                                                                                  a91cfa61c1619d5ddc7b67337f40c461

                                                                                                                                                  SHA1

                                                                                                                                                  d47f11d3804a4108e7011212b752161e9b32b66a

                                                                                                                                                  SHA256

                                                                                                                                                  626af4bec3d5937f6cb87dae0173b72213cc6667f4978b7587e5c01c439870cb

                                                                                                                                                  SHA512

                                                                                                                                                  92078a4489184aece69e3d114cdcf06181693c0e9526f7b698c1002e3c0bc207531e582c54f754c379296f920c0b14b12768dd3e3fa333c7c1a976942e9d8fe8

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  57KB

                                                                                                                                                  MD5

                                                                                                                                                  c609d9cb1786eabc73151db812927314

                                                                                                                                                  SHA1

                                                                                                                                                  b1c286bb8ef437152f6036c3f8e06ec823f707b9

                                                                                                                                                  SHA256

                                                                                                                                                  1fde296a1750e4a431bc4b978989a1b43a51aa8b583390b2e8968a278fd5d2ac

                                                                                                                                                  SHA512

                                                                                                                                                  0d9c69eb45c4a0e86d875e929a3f93a89e908b23457ee1f80d754733f11a1d4ae07bd94b7cd6ff141ae597818b46b91b3de847ad125b67fb613a24b29f33436f

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  70KB

                                                                                                                                                  MD5

                                                                                                                                                  3422eb8e002178f59c92355c1ca78393

                                                                                                                                                  SHA1

                                                                                                                                                  eae49e0c467a6aeba668b5ee6adabb393a57e717

                                                                                                                                                  SHA256

                                                                                                                                                  14ea295a4db82f8890e935c21c4ba92c86de3a674aedf323099689b0bb96a7f9

                                                                                                                                                  SHA512

                                                                                                                                                  6945496d88705317deceeac74d8f8279b16cd77ca0ac20772260dd77178c099a57338010c927a1591c515fb05bf73a9ddac4e9389eb0de31c4c16341555e2342

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  61KB

                                                                                                                                                  MD5

                                                                                                                                                  2dd70baf08ca9a226135fc5c98056c1e

                                                                                                                                                  SHA1

                                                                                                                                                  3769412660cd5f081bf7f3c4ac634cf0a1b60362

                                                                                                                                                  SHA256

                                                                                                                                                  c1fe16ad8b9e00e8f0dbceafe0be6b68c3d91801c444c6ed1ad46549e56de44c

                                                                                                                                                  SHA512

                                                                                                                                                  4900594b3bed48d1c93801c07c49d21255aed5e030365878f8fb5db9583a5a1696b2010d463b2d13f480bd37e2ff1ee45784e0488e5cc3ef18b9b600b157e10f

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State~RFe58d230.TMP

                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  a2beb8c9737232a5b4880405041bf734

                                                                                                                                                  SHA1

                                                                                                                                                  61bffae85af39ec031994be4b2b2377423149f38

                                                                                                                                                  SHA256

                                                                                                                                                  d310e49b953298601470cddb42fa959212d36917da3bb75fbb229404da0c72c5

                                                                                                                                                  SHA512

                                                                                                                                                  5435d4e0c1fea478ca5ae320748733fe0f6cfe97be9541f233b0c3e3f6e109994dec04ec04a7cad6ce56b84d5a8b596992afa888b3e8746d282681b1943d5336

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\PKIMetadata\1184\crs.pb

                                                                                                                                                  Filesize

                                                                                                                                                  141KB

                                                                                                                                                  MD5

                                                                                                                                                  57086b02f74c3fe7b79a5e2e3d852322

                                                                                                                                                  SHA1

                                                                                                                                                  6420387225ddcd5210175de4f3fdb0ab2be8ee9c

                                                                                                                                                  SHA256

                                                                                                                                                  a1b5be8d4aab349aff58ed34e1f3bc6647cf440830da0a12a8bd5a1c976c6407

                                                                                                                                                  SHA512

                                                                                                                                                  b195eb9a9129863e75be603b00b85ecfe46360910529fb38513af6940f9d17efd56f234b47963452329cd85b16bebb5a85ab5d304743e57d33bafd5b59900468

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\PKIMetadata\1184\ct_config.pb

                                                                                                                                                  Filesize

                                                                                                                                                  50KB

                                                                                                                                                  MD5

                                                                                                                                                  46b4d311088a1b5476ef5378009fb040

                                                                                                                                                  SHA1

                                                                                                                                                  5f4e068b959d6b52a46f4ce9bbca3149fd3178bd

                                                                                                                                                  SHA256

                                                                                                                                                  33f556efb669f0078999e06d42d3d29393a3909e6775f3fc2eb59e28588b6c14

                                                                                                                                                  SHA512

                                                                                                                                                  3f85d8f6eaea9c8d39df16a527b9d78faa67549af4c1e4ae59fa7bb6bc0acabfb35ad808cfe94fda07e60ffcff26e0c0b508f39e1aa6ecbf63dd9da845128400

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\SSLErrorAssistant\7\ssl_error_assistant.pb

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  e2f792c9e2dd86f39e8286b2ead2fc70

                                                                                                                                                  SHA1

                                                                                                                                                  8a32867614d2a23e473ed642056ded8e566687f9

                                                                                                                                                  SHA256

                                                                                                                                                  ac354a4723aaa4f06bec385ddde4a4d0983ad51456f52b31a8068ec97d5b5ea7

                                                                                                                                                  SHA512

                                                                                                                                                  6a7af0ca1efa65a89a9ca3b8df0d2e24f21d91673c60cdfeeb02d33647442b01d535497249542f40e66e0d2dd3e9f8ed1f4a201fd97138d07a2b71366737e580

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\SafetyTips\3057\safety_tips.pb

                                                                                                                                                  Filesize

                                                                                                                                                  163KB

                                                                                                                                                  MD5

                                                                                                                                                  bd6846ffa7f4cf897b5323e4a5dcd551

                                                                                                                                                  SHA1

                                                                                                                                                  a6596cdc8de199492791faa39ce6096cf39295cd

                                                                                                                                                  SHA256

                                                                                                                                                  854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

                                                                                                                                                  SHA512

                                                                                                                                                  aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\TpcdMetadata\2025.1.6.1\metadata.pb

                                                                                                                                                  Filesize

                                                                                                                                                  33KB

                                                                                                                                                  MD5

                                                                                                                                                  0f83ea8aad2d94a32037e90f2812611d

                                                                                                                                                  SHA1

                                                                                                                                                  66a2879b881176df793c94f6833441fe153e5135

                                                                                                                                                  SHA256

                                                                                                                                                  628b2de57b5dde868a30e9c45ffc6ff35a820c93a90d3f4ff61a1ff5396eaf54

                                                                                                                                                  SHA512

                                                                                                                                                  e676aa774c099e43c00ecd42d2f10ae194910d9b694629abdba763aefc1d2c541cb1133ad3bf74df08fc6f8fb32b3f3047c07375977ee8d0f8bad9eddb7bc388

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\adcocjohghhfpidemphmcmlmhnfgikei\1.0.283\list.txt

                                                                                                                                                  Filesize

                                                                                                                                                  149KB

                                                                                                                                                  MD5

                                                                                                                                                  5f5455741ebf6bbb4293184c410b4414

                                                                                                                                                  SHA1

                                                                                                                                                  f97f61dab887a098bdb2ce5b2a5aef020f54e5c4

                                                                                                                                                  SHA256

                                                                                                                                                  2f0e8f3d3126a613fe37503fe314cec4553d7c47cb1d5dc32dbb4e2a10b4709c

                                                                                                                                                  SHA512

                                                                                                                                                  5629aa5b07690e73bf246555a8dab56bfbca07d62571048fad6a58a97fd93b09be93557b40667c92f3f6667530e1a0757b76d93812e0d11ee1972e0c690e9f5e

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\Greaselion.json

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  7a611abbb6a9a924867db6020cb190d0

                                                                                                                                                  SHA1

                                                                                                                                                  e2f19e2ef273b9f5ae247873ce3306e774961d3d

                                                                                                                                                  SHA256

                                                                                                                                                  b080bd46957a74b2d321e701237222980c202f4139bc4c33056e8b8824f64402

                                                                                                                                                  SHA512

                                                                                                                                                  6646e87023a890e63c7c7aa6b006b41dddfc7b9005a9d70fc114e45614e8bb652fcf4450f7bdf6326d31611d4d4c12f40cdd690313d56d6b214682d98a5ac898

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\clean-urls-permissions.json

                                                                                                                                                  Filesize

                                                                                                                                                  268B

                                                                                                                                                  MD5

                                                                                                                                                  00acb0f14b6b6c11ce80107110ead798

                                                                                                                                                  SHA1

                                                                                                                                                  2a40b0217ddea6d507234f236d3889b46ee35baa

                                                                                                                                                  SHA256

                                                                                                                                                  2e666bd0d92b08bddac4487b184c5612dc408f21fe4f3fab78a7ce1b2fa3f8ca

                                                                                                                                                  SHA512

                                                                                                                                                  c3a53397be2fcf41702524cb42c8d2b49d4cbde4c5479c6d0d6e92152cd213dd7436d7729906d76ed003d64e806cdf66dda7f3ca8dd4b9f9efabe25ffb76c2cc

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\clean-urls.json

                                                                                                                                                  Filesize

                                                                                                                                                  18KB

                                                                                                                                                  MD5

                                                                                                                                                  3e6714a16e04d03f205a85f2563eb1aa

                                                                                                                                                  SHA1

                                                                                                                                                  a76641cf3a4745ae2e4426fb10b73a6af4f1f272

                                                                                                                                                  SHA256

                                                                                                                                                  3c09ee2c055819d0ce5368cfcb19cd5384e2916d7a5c2332f59ed60b3545b0c0

                                                                                                                                                  SHA512

                                                                                                                                                  05062fd40cf019b7367c2cf65d2fd219fd4e602111e9bd20b76545dc890f20fc4d1ed798d630bc0821d52ef4c35bd83e63bb84971d10f162d4c6c12eda8526b0

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\debounce.json

                                                                                                                                                  Filesize

                                                                                                                                                  11KB

                                                                                                                                                  MD5

                                                                                                                                                  e0df2d0dc75d2deac9eebbe0ba8db9ab

                                                                                                                                                  SHA1

                                                                                                                                                  d0636e518045a34eb081096f86609744fa47ddab

                                                                                                                                                  SHA256

                                                                                                                                                  5f05b84687de1011614eb1ededfe23d6f98fb2be47ea1a04bae0c95d9a3113c2

                                                                                                                                                  SHA512

                                                                                                                                                  c086e251cac5c121b8841f0dbfd2a45af99991a8b4bf584727c6bbe7e1e52d2361d2ffeb099be5da937b17d3ea36882d7516ebb294b5f2ccd9959424c2a5a0e0

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\https-upgrade-exceptions-list.txt

                                                                                                                                                  Filesize

                                                                                                                                                  86KB

                                                                                                                                                  MD5

                                                                                                                                                  b8ebe8c70e14e1bdff4bf04cee9055a4

                                                                                                                                                  SHA1

                                                                                                                                                  6a8eeeb539eb5f630091a971585bc77731c24b12

                                                                                                                                                  SHA256

                                                                                                                                                  a9c464c1aa17ec9958141c020c30badddd4801e15b9c0a0d430859df0ad1955e

                                                                                                                                                  SHA512

                                                                                                                                                  9240b1d7ae17b6d20cb21a466335471d3b62ee2866e6d07dc62c1a288def513cedb5368891e4c8beecd135140a221bf8a16e048cced31b29fff9f8d0d40c7266

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\webcompat-exceptions.json

                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  54b1343eed0640cc4b415bd1ef50dba1

                                                                                                                                                  SHA1

                                                                                                                                                  df0a9d4bc264e7c9325a9d082ddb3ff8dea528ba

                                                                                                                                                  SHA256

                                                                                                                                                  9344abffe1529919decfc08c1f171600319625ef7ec9a6d63dfac4927d6246b4

                                                                                                                                                  SHA512

                                                                                                                                                  c7689d95879d890425e95322613167cb6be9c04f207e847fa3f6da4c752413325968a667fd3044d8cf08a74537a1affaffd02dfa33397079bdc603768f757e92

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.15\StudentNTP_Sam-Richter_x0825_WINNER.jpg

                                                                                                                                                  Filesize

                                                                                                                                                  544KB

                                                                                                                                                  MD5

                                                                                                                                                  f66e5fa138432af6b40849484545b809

                                                                                                                                                  SHA1

                                                                                                                                                  25942df987649a1bddda636686064d29dca799a6

                                                                                                                                                  SHA256

                                                                                                                                                  65b5f21ccdcbdb23f39baf036ae5eb3999f3e88e241bc57a3a4d1bf0fbfda605

                                                                                                                                                  SHA512

                                                                                                                                                  29a512f0f028b2c4e53f492f6a4fe27cc88b547334466341b08b70724b16e7eaaf70cb0308e251f404aa6b80db972a553438afc3894440e1b1ed0962ec7a5319

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.15\photo.json

                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  a7e80c8cc5121a2febc654140e53ac32

                                                                                                                                                  SHA1

                                                                                                                                                  c3b1b578dcbf91aa19e65d0ef6974c165723828e

                                                                                                                                                  SHA256

                                                                                                                                                  a2595174656b59176071c0b79b404efa7246a9242c2bd19545155194c6b8cf99

                                                                                                                                                  SHA512

                                                                                                                                                  d7ef1e8df49956bc212388ef7a5343b9836e825c4ff066aa65bf0f3a136ecee4b63ff807dd63eb33e6e812e470d644eccaf3a7f61a816e441ffc44a982690577

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\bfpgedeaaibpoidldhjcknekahbikncb\1.0.10543\list.txt

                                                                                                                                                  Filesize

                                                                                                                                                  54KB

                                                                                                                                                  MD5

                                                                                                                                                  262dd57421040a5921ea34eb5de17986

                                                                                                                                                  SHA1

                                                                                                                                                  383dbf524f3291be8a1fcef5c8e8d93c169844dd

                                                                                                                                                  SHA256

                                                                                                                                                  a72856c53e7954ebfe6fb531599c04152d32384a0009df7bd45e9827f3ce1d6a

                                                                                                                                                  SHA512

                                                                                                                                                  5a6a9cb00dd95ca210893d136ea4481dde07d53352d92f8500190e3b27f5ce5adae0c6d8134b33e9b118bdddfc1a27953de6b44b621061dafadd2fdc8276debc

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\cdbbhgbmjhfnhnmgeddbliobbofkgdhe\1.0.11714\list.txt

                                                                                                                                                  Filesize

                                                                                                                                                  1.4MB

                                                                                                                                                  MD5

                                                                                                                                                  07fa9b64cddebc416dd01a01c27f59ce

                                                                                                                                                  SHA1

                                                                                                                                                  4d356a14bcd09e6b8d0cd92520aa439da893a6c3

                                                                                                                                                  SHA256

                                                                                                                                                  cc4ba85e1e33b970a0022e5d46ea3666a190b5e1a20915b4aebc7f70878b9a5c

                                                                                                                                                  SHA512

                                                                                                                                                  a1ee8d0f0ca78b2a8398d4e7b93e735fd9f0c59ec949cf87ce37e85d504595f42359fad8c3eaf4ef873be93c774b2d71ed6986cd73b97a86583bf403c8aa1041

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\adcocjohghhfpidemphmcmlmhnfgikei_af0c3b4e4f6e5a6d36a9e48d7fc2a6b897e9b489074c17d563f899ae06a3237d

                                                                                                                                                  Filesize

                                                                                                                                                  50KB

                                                                                                                                                  MD5

                                                                                                                                                  c585ab88774559f466e99ac16889b9f2

                                                                                                                                                  SHA1

                                                                                                                                                  e69ae7851e81b7ed095be003688e860db838c272

                                                                                                                                                  SHA256

                                                                                                                                                  af0c3b4e4f6e5a6d36a9e48d7fc2a6b897e9b489074c17d563f899ae06a3237d

                                                                                                                                                  SHA512

                                                                                                                                                  9405d7de2fe7f6a75fd786634bc8e1e2d3cb2ade1e82984e1369a8798900a8e5f28d1627ac09ad93e5e26e621ce1c2ef8bee7596ee832030d009e228b3eb8439

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\afalakplffnnnlkncjhbmahjfjhmlkal_a58adefdaf784d8e18be7361cc1fc0754006ab0645db39e030cbd2198fa1635f

                                                                                                                                                  Filesize

                                                                                                                                                  71KB

                                                                                                                                                  MD5

                                                                                                                                                  08e05280d696d07c593d854939f5797a

                                                                                                                                                  SHA1

                                                                                                                                                  044db06c4654fe2e82fa2bc1ed4da36ee95fe323

                                                                                                                                                  SHA256

                                                                                                                                                  a58adefdaf784d8e18be7361cc1fc0754006ab0645db39e030cbd2198fa1635f

                                                                                                                                                  SHA512

                                                                                                                                                  1e18235702880626275e41ffe5bcd81ed0b44e790980da3356cc924eccd9f9437bd1268e9a6b2f94ceb648ba740001c7b91b77e8d24ed9ebddc095806d7397d2

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\aoojcmojmmcbpfgoecoadbdpnagfchel_9f86d8efba865ca6f98389b7c55e368191b7954cd10b872da84de0b5382a247a

                                                                                                                                                  Filesize

                                                                                                                                                  12.1MB

                                                                                                                                                  MD5

                                                                                                                                                  89c01a540e21a6012c4292eac6100dbb

                                                                                                                                                  SHA1

                                                                                                                                                  2bf600a9d372f38d37c64a9df5cb26d5cb046cf9

                                                                                                                                                  SHA256

                                                                                                                                                  9f86d8efba865ca6f98389b7c55e368191b7954cd10b872da84de0b5382a247a

                                                                                                                                                  SHA512

                                                                                                                                                  abd83f91b97c9c9bba4cb82501a6d316ef07173e4916e87a13f888ad32947b424d18bd6186a36245b2bd9f6c6cd29ccaaaf2445b3e5754c30ea53f1ab6016f25

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\bfpgedeaaibpoidldhjcknekahbikncb_9c62d120b9dbbe41d27008c5d5114eaea784e552e02af7e4cd2a19b9c8b87393

                                                                                                                                                  Filesize

                                                                                                                                                  18KB

                                                                                                                                                  MD5

                                                                                                                                                  c3ac78eca3de7c0e238f8599337fe2f0

                                                                                                                                                  SHA1

                                                                                                                                                  220c74e6e7b096a052056d2f26397e0de5175821

                                                                                                                                                  SHA256

                                                                                                                                                  9c62d120b9dbbe41d27008c5d5114eaea784e552e02af7e4cd2a19b9c8b87393

                                                                                                                                                  SHA512

                                                                                                                                                  59863e9be405c61963989c95a87b91808d6059e5baf7aa0b5477f2dfb6850ae2287ddf6d0b7299100e587845eaeef43619b3a6679a7a1d781d9dabea8cf00903

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cdbbhgbmjhfnhnmgeddbliobbofkgdhe_3dae87e0085a88c01f809337774b8f671525855e9207ebb9e662318b7e1e8841

                                                                                                                                                  Filesize

                                                                                                                                                  414KB

                                                                                                                                                  MD5

                                                                                                                                                  9fcff2e1cc20ba7670271df1028fac6a

                                                                                                                                                  SHA1

                                                                                                                                                  7502f0e5953b7c8cd7d9a6d28efbdb6732c6b5af

                                                                                                                                                  SHA256

                                                                                                                                                  3dae87e0085a88c01f809337774b8f671525855e9207ebb9e662318b7e1e8841

                                                                                                                                                  SHA512

                                                                                                                                                  55971103716adf42e13f27603f52ba84258ff6d1a766884f73725f84011a44e28d81d8009cfd0ecaf527981972ad8218b4e5d80965398fab252b13b6012f1a3b

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\efniojlnjndmcbiieegkicadnoecjjef_1.9645143596dd859c7d9cc843cf13378660ea1b16e7689770d229142a0a3724c8

                                                                                                                                                  Filesize

                                                                                                                                                  150KB

                                                                                                                                                  MD5

                                                                                                                                                  e1900863188285f81af2e44329c5dfc3

                                                                                                                                                  SHA1

                                                                                                                                                  fc1234b818d73e3925c9e308644c39b7b0a1eae9

                                                                                                                                                  SHA256

                                                                                                                                                  9645143596dd859c7d9cc843cf13378660ea1b16e7689770d229142a0a3724c8

                                                                                                                                                  SHA512

                                                                                                                                                  be5c29c05ba5a79118e5b4d3223c27b50a00e89b429865267cc468a447fce91ec6e27fb5efef108e362a9d5722ef915cbf453199253b8b08560247be2566ebe0

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\gccbbckogglekeggclmmekihdgdpdgoe_7ae9fcf993f68854c48606c69e5456b84f6cb59cec730bd45b11262076c2470d

                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  332676df5849a5a90f9ed4d9b1dde14f

                                                                                                                                                  SHA1

                                                                                                                                                  06913ab5f20a32c129fc0dd467f785958ed97071

                                                                                                                                                  SHA256

                                                                                                                                                  7ae9fcf993f68854c48606c69e5456b84f6cb59cec730bd45b11262076c2470d

                                                                                                                                                  SHA512

                                                                                                                                                  acb356e36a3d898baf4855a32eb0704e8653f50cddfb0cab503aa5972088aef9a2cacff83a1f71220e2a3d3b595537f40a62067bb8bd5027806a3fc215609b20

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ggkkehgbnfjpeggfpleeakpidbkibbmn_1.3525216abfc685f109e0efae397d7afe8bd1aec6d081fefc730947cd3e734f2f

                                                                                                                                                  Filesize

                                                                                                                                                  10KB

                                                                                                                                                  MD5

                                                                                                                                                  81c39099b5a4e221569eeec0a746af7b

                                                                                                                                                  SHA1

                                                                                                                                                  0601105a54e905370e965cbf8cf78bd6d8e300c2

                                                                                                                                                  SHA256

                                                                                                                                                  3525216abfc685f109e0efae397d7afe8bd1aec6d081fefc730947cd3e734f2f

                                                                                                                                                  SHA512

                                                                                                                                                  42011c20c52733df0116c4661efdce06d8ec70dd38cfae2cad45e4b4eb7cb24ab4061e968e4d5766e4203b8c4caaf2b6727e55bdf78402157a19eca0f2e89140

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\giekcmmlnklenlaomppkphknjmnnpneh_1.3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a

                                                                                                                                                  Filesize

                                                                                                                                                  5KB

                                                                                                                                                  MD5

                                                                                                                                                  636c653ec2c30bb767533901a18669b2

                                                                                                                                                  SHA1

                                                                                                                                                  4b5a01cfea4c5deb62f3aafa01ef24265613b844

                                                                                                                                                  SHA256

                                                                                                                                                  3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a

                                                                                                                                                  SHA512

                                                                                                                                                  a4128fb20a5df9e573e92b45f5bc18dcdf4be6e7e39172d08847882f17361320141e89b35deef337e40c365d6f1ccdd1b991eb4593d805dfa2e39a5257c335ee

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\gkboaolpopklhgplhaaiboijnklogmbc_9b0a6f79321f3960467e7d3e3b3e9817d3ef281c405da30852606bc8c9cc588f

                                                                                                                                                  Filesize

                                                                                                                                                  76KB

                                                                                                                                                  MD5

                                                                                                                                                  34f31f85a6b2a69a074939e4e231a047

                                                                                                                                                  SHA1

                                                                                                                                                  97f6d1a966baa94e686aef7fece23bbf099fb8c6

                                                                                                                                                  SHA256

                                                                                                                                                  9b0a6f79321f3960467e7d3e3b3e9817d3ef281c405da30852606bc8c9cc588f

                                                                                                                                                  SHA512

                                                                                                                                                  20f4d9efe5450e1f02608d382c97bd4269298c87763a4abcf63a5fe0ba62dd0c391824964084cc011ed6cd7db99c19c9b6411b04d42539081f3737dc78a2f2ed

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\heplpbhjcbmiibdlchlanmdenffpiibo_69d8f36372ec6edbfc4bdd957f954cc2aa97c9dc8c7992c1575b072632f3157f

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  MD5

                                                                                                                                                  3a03f3ab4119a23fa6b70a32a6fcd4b0

                                                                                                                                                  SHA1

                                                                                                                                                  5d047a5da7c7f388416aa50b5fba745bf5f36eb8

                                                                                                                                                  SHA256

                                                                                                                                                  69d8f36372ec6edbfc4bdd957f954cc2aa97c9dc8c7992c1575b072632f3157f

                                                                                                                                                  SHA512

                                                                                                                                                  8caa4e94e831b25226e956a8ee87c5b369547081df863ee34e7f80d686259eb9b7bf75757043ecc5b0eda3a603198da060f9b6f30be755350ab912fdc7681819

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\hfnkpimlhhgieaddgfemjhofmfblmnib_1.a15da3a7e848826e5277be2aecf58ed6e62750b989f4d13ccd0931235d341eae

                                                                                                                                                  Filesize

                                                                                                                                                  595KB

                                                                                                                                                  MD5

                                                                                                                                                  f7a991c294a1aa710833441826dce077

                                                                                                                                                  SHA1

                                                                                                                                                  77abb0a5c41efdb264c794760bb9a5df086342f7

                                                                                                                                                  SHA256

                                                                                                                                                  a15da3a7e848826e5277be2aecf58ed6e62750b989f4d13ccd0931235d341eae

                                                                                                                                                  SHA512

                                                                                                                                                  cc5f70cca942b34441aeef37eb193286cfcec633423f3be181b926d21b44c6889fb32744f70882277fefcaab515770c74d1e72fe9242dd2065dd0ac27e600fb9

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\iblokdlgekdjophgeonmanpnjihcjkjj_44fdfde835126a128fd9f020a2d7c388491ab5d251a107e4e10b6f24b63e7d72

                                                                                                                                                  Filesize

                                                                                                                                                  17KB

                                                                                                                                                  MD5

                                                                                                                                                  a1b36d762732f9439efa78708a40dafb

                                                                                                                                                  SHA1

                                                                                                                                                  6533b78ae795077fa711c67347eabdc88b5a6c6b

                                                                                                                                                  SHA256

                                                                                                                                                  44fdfde835126a128fd9f020a2d7c388491ab5d251a107e4e10b6f24b63e7d72

                                                                                                                                                  SHA512

                                                                                                                                                  8dbfd514f87e7b929ab9d2b61f99939b3cf687947dff980ce3378b56127785acacde7b8fb4ff034e2a31f8cec1901605c6216b6846f5d2a199a245bf6144e05d

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\iodkpdagapdfkphljnddpjlldadblomo_3f0dd6bb4272b8ed316fcdf1b83a42c5c79ed9d90b4116f832235b4aacd7afe6

                                                                                                                                                  Filesize

                                                                                                                                                  1.6MB

                                                                                                                                                  MD5

                                                                                                                                                  3d291b4ff86952e148fc001a548e308e

                                                                                                                                                  SHA1

                                                                                                                                                  0ef9e15b2b92a9f4775e742e1a5cc28187c7b15c

                                                                                                                                                  SHA256

                                                                                                                                                  3f0dd6bb4272b8ed316fcdf1b83a42c5c79ed9d90b4116f832235b4aacd7afe6

                                                                                                                                                  SHA512

                                                                                                                                                  fcd4f4917e8ccd87e944d4282343e099b4de882f1cbb3b8f7c1f6e470a5e1d4f2efb23a2c5307630c4593e0f747cfc48c65f26c029fbfb3b39c7b3c96c0db7ad

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jamhcnnkihinmdlkakkaopbjbbcngflc_1.c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70

                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB

                                                                                                                                                  MD5

                                                                                                                                                  2ac309d48a054c8b1d9ea88bac4dbd6c

                                                                                                                                                  SHA1

                                                                                                                                                  7507922d88a9cb58759b5326fadae5d0c87f40b2

                                                                                                                                                  SHA256

                                                                                                                                                  c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70

                                                                                                                                                  SHA512

                                                                                                                                                  870dbb86a67f36a43ad4c80db904e76b602bbe062cbb9fe4222d1cc69d99aa4a60aae91c094a65a481d8c62cca4942f178f1b2744ed21836a526c7ffe3409969

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jflhchccmppkfebkiaminageehmchikm_1.4a54c9608d3cd43d98b0a7efb59dbf0dbb96a894b590c8c12aa887d919a3fa62

                                                                                                                                                  Filesize

                                                                                                                                                  9KB

                                                                                                                                                  MD5

                                                                                                                                                  0cb054719539c9976740cbf6347deda4

                                                                                                                                                  SHA1

                                                                                                                                                  f67b7c673822110edbaf783c4ba6002914f233cb

                                                                                                                                                  SHA256

                                                                                                                                                  4a54c9608d3cd43d98b0a7efb59dbf0dbb96a894b590c8c12aa887d919a3fa62

                                                                                                                                                  SHA512

                                                                                                                                                  7da4b2d87af6f0601479417cc6bd5390dcab2aefe03ae9414bd7f9b8b033baf8b7952eef7d1f9f465d7472cc14b40bca37c583e00fd6508d5388c19db1c26c7f

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jflookgnkcckhobaglndicnbbgbonegd_1.e698359726dbebe13881db2d3d53856d8a3a1ffba048ac94773036cd08a60240

                                                                                                                                                  Filesize

                                                                                                                                                  77KB

                                                                                                                                                  MD5

                                                                                                                                                  1068b68cfdad67e39e13fb7b97adbdb6

                                                                                                                                                  SHA1

                                                                                                                                                  d3dac92d9c28b948ec33699ff69ae75a900de6cb

                                                                                                                                                  SHA256

                                                                                                                                                  e698359726dbebe13881db2d3d53856d8a3a1ffba048ac94773036cd08a60240

                                                                                                                                                  SHA512

                                                                                                                                                  da6c4d63d8d22e231d5101d93429a3ecc33c89d62b5fc969c7276816d79f8cbe45a16652507581480edb83b61f0e1c57f41e4432f6fdd67c878f38e0d4eef64d

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\khaoiebndkojlmppeemjhbpbandiljpe_1.44c97a8527ef50cab95a16c5e78cd321cbdf315726823afe7e0482af9eb18319

                                                                                                                                                  Filesize

                                                                                                                                                  5KB

                                                                                                                                                  MD5

                                                                                                                                                  93e97a6ae8c0cc4acaa5f960c7918511

                                                                                                                                                  SHA1

                                                                                                                                                  5d61c08dde1db8a4b27e113344edc17b2f89c415

                                                                                                                                                  SHA256

                                                                                                                                                  44c97a8527ef50cab95a16c5e78cd321cbdf315726823afe7e0482af9eb18319

                                                                                                                                                  SHA512

                                                                                                                                                  e61727a277d971467e850456fbc259dad77a331873e53e3e905605cd19b01c2dc46df7400ce8442e39cfac5ac3fbcd833ec7310c7ab1c3380d900dd676ed1679

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\mfddibmblmbccpadfndgakiopmmhebop_bdf60991017fe5e955ab0be306333b5427fac3db247bad1f24709d4c9c4b6ef3

                                                                                                                                                  Filesize

                                                                                                                                                  179KB

                                                                                                                                                  MD5

                                                                                                                                                  62af22ce07e0375e66db401f83384d5d

                                                                                                                                                  SHA1

                                                                                                                                                  468b255ebdfc24ff83db791823bca7e78b09f3b1

                                                                                                                                                  SHA256

                                                                                                                                                  bdf60991017fe5e955ab0be306333b5427fac3db247bad1f24709d4c9c4b6ef3

                                                                                                                                                  SHA512

                                                                                                                                                  54dd31001427a97665dad169b0d5f32fdb79a89eac7fa23a164bf78095be2d2e5f9195eb9ffedc2d1998f839781e32515baeae482ec74d8409b0d58fe53993e1

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\obedbbhbpmojnkanicioggnmelmoomoc_1.fa5d70ce715434cda9953be8a723c89384b00cf99e931dd43be46fa909f83371

                                                                                                                                                  Filesize

                                                                                                                                                  5.1MB

                                                                                                                                                  MD5

                                                                                                                                                  ba2dd3578e017160515508a271b9f664

                                                                                                                                                  SHA1

                                                                                                                                                  b5898eabc9b14b4d2b296a757ceb5468a7ec1e69

                                                                                                                                                  SHA256

                                                                                                                                                  fa5d70ce715434cda9953be8a723c89384b00cf99e931dd43be46fa909f83371

                                                                                                                                                  SHA512

                                                                                                                                                  5adbc5de11e3b153781e362c23464daf543970ea693f0ffe43dfa393de6cec13a54d74a82182db1263c59664722fb5ae979345a4bf50dceef8441544e0d11b79

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1843\733265a5-cb2e-4388-80d8-41ff2aca4f74.png

                                                                                                                                                  Filesize

                                                                                                                                                  33KB

                                                                                                                                                  MD5

                                                                                                                                                  050c997c097ff116d74ebfe55e4987f9

                                                                                                                                                  SHA1

                                                                                                                                                  6e150b6df1b0bfb17558f6af3e455619b68f124d

                                                                                                                                                  SHA256

                                                                                                                                                  03317454364bc4692da57b78a0f1fab8173b364374f5f165bf536115a37dba88

                                                                                                                                                  SHA512

                                                                                                                                                  0be0912147351e713bc09bea22ed485d0761bc442ce5a73053a3ac81eb9c8cd2f917132a0add117d44ccab6c15a90b547e4f3a7c10f86f7f500999b854d683a1

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1843\d7f67249-f019-4471-ad6d-6b66323241b7.jpg

                                                                                                                                                  Filesize

                                                                                                                                                  385KB

                                                                                                                                                  MD5

                                                                                                                                                  120738eebdcbafacf867275bde67052a

                                                                                                                                                  SHA1

                                                                                                                                                  7c65e8a52a17a9baf9a21433c51a950527dd669c

                                                                                                                                                  SHA256

                                                                                                                                                  e291c22f5ac81b04d8e7aa71eab41dc4ebdf4e02b855ebc069915200bae737e1

                                                                                                                                                  SHA512

                                                                                                                                                  2e22bf34a08dddea168ebc00e2269f84456486885d5566cc7e8647d793138b6e523da7a002c13520410f4c972b59e0e2a78ca6f7b8d4d1f5e7615128e0b8d98f

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1843\photo.json

                                                                                                                                                  Filesize

                                                                                                                                                  3KB

                                                                                                                                                  MD5

                                                                                                                                                  7f469d0fa115666441b89b6071e83db0

                                                                                                                                                  SHA1

                                                                                                                                                  67ddb4779574f6aea3cfe1ebdf4ac7fe689bb5e5

                                                                                                                                                  SHA256

                                                                                                                                                  800fc7488d95825f4cf8edc45a6d0241a0f5e217f4c35b68bd82c051dd8ed249

                                                                                                                                                  SHA512

                                                                                                                                                  79fade254ed89f9179f12504a6b518bfc3d01552d5318121432b6255a8ef8cca4381264a696f1392d84a4066d99b82140d23e2a79ea2fe3231acc1f3ef45383a

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gkboaolpopklhgplhaaiboijnklogmbc\1.0.69\list_catalog.json

                                                                                                                                                  Filesize

                                                                                                                                                  76KB

                                                                                                                                                  MD5

                                                                                                                                                  d1d6a9d9cc2ada3f3bad8b0da607f4eb

                                                                                                                                                  SHA1

                                                                                                                                                  1d286de6436a8a28584744f022af73077ed64601

                                                                                                                                                  SHA256

                                                                                                                                                  f1a889c0f11e2642c299774f601b72b5cc51e86bb1fa7514cfa9f4fa1a9538ad

                                                                                                                                                  SHA512

                                                                                                                                                  4c43a10995b91d2791a8274813f005feab48d83078fb8b51f026266ff524ffbc53c41d507d801101a9a7f765453ab4b08398f4e743b6beb08036b72e40b82934

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\heplpbhjcbmiibdlchlanmdenffpiibo\1.0.11\mapping-table.json

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  MD5

                                                                                                                                                  57ff689022f2d93d2287ac3b48daec73

                                                                                                                                                  SHA1

                                                                                                                                                  937b7dc21193a27607340af7fb7b987b8ea50582

                                                                                                                                                  SHA256

                                                                                                                                                  4665c8cb39b1fd0131b72097484bd3a8309992821a21de9ee0420434cc3f7d5c

                                                                                                                                                  SHA512

                                                                                                                                                  1b81c2c9df45875c2f563b99bb2d29972408e3d449fb2e8793822dc0cf85c41cb48eb92510f4940343ae4826ec9bb4b98093d64f53de635ccf75b5307b92ca87

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\iblokdlgekdjophgeonmanpnjihcjkjj\1.0.106\resources.json

                                                                                                                                                  Filesize

                                                                                                                                                  269B

                                                                                                                                                  MD5

                                                                                                                                                  20effecf10eeb0456cc6f537c802f172

                                                                                                                                                  SHA1

                                                                                                                                                  8fb3968af27ad30c639f45a6fcee99b48ef79878

                                                                                                                                                  SHA256

                                                                                                                                                  044502a67e39049b4cfe2b80295ad396fff4d1a28e7f2a1200abf21061aace8d

                                                                                                                                                  SHA512

                                                                                                                                                  6a002b205519c0fc498c139d1efcab2f26bc03f3fa795a5bee9b3358c9796088bb6419e2b95afdbb84c5ea36a328dfab01b33c148c84dd8e3b9d21fa07fb6dce

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\iodkpdagapdfkphljnddpjlldadblomo\1.0.9952\list.txt

                                                                                                                                                  Filesize

                                                                                                                                                  5.6MB

                                                                                                                                                  MD5

                                                                                                                                                  c25ad1a329b6431052a09ca5192eddb1

                                                                                                                                                  SHA1

                                                                                                                                                  e3a8e1e1d92cac2a00cf50fcd5ef5427f09059ac

                                                                                                                                                  SHA256

                                                                                                                                                  a44bdcbddbd27a88fc56d212439ed9f4fdc8b80c5692bf278870a91da34efb41

                                                                                                                                                  SHA512

                                                                                                                                                  44ec2ab426cd78cd0d822b68f0194b8fa07e244f54d2739c1d9fb82615a75da220a1a8e2f6844417b9937a34fef95e621bf280382375578a1c3ede5218af594b

                                                                                                                                                • C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\mfddibmblmbccpadfndgakiopmmhebop\1.0.104\resources.json

                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  f7e232619fcd50a55c3df6ffbab0245f

                                                                                                                                                  SHA1

                                                                                                                                                  f26eff68192fa88acc08ed97979c258f8f534a33

                                                                                                                                                  SHA256

                                                                                                                                                  f4e1a4ce5d42af762210fc9218115a1048d3564ffbc987b4c47f1d9321dd35e7

                                                                                                                                                  SHA512

                                                                                                                                                  bbe0d62000740c6958e8630af812bc388011a225785e3f8b3b7ccdf2e033a42d63db566df030244ac22884d005f5f2048b4a506ae64a8e7062395b8bf08430f4

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                                                                                                  Filesize

                                                                                                                                                  649B

                                                                                                                                                  MD5

                                                                                                                                                  94f2e947f3afe44d1a01214e4a33e6d5

                                                                                                                                                  SHA1

                                                                                                                                                  c428a4d671ca0eb14bcaba50fd37896bdec26ec9

                                                                                                                                                  SHA256

                                                                                                                                                  aa3002818a8ce908a59de1d2d67ecedb2daac48aba4fe1d037be84c52cbe6d5c

                                                                                                                                                  SHA512

                                                                                                                                                  1876539a1a4a0cb1600ada85080a2bf4b505ada1ce32c43fbe5d2c7170775e9678c0a495241ae36c50733eaff869535bf869c6641744386b88271140ddb82bdc

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

                                                                                                                                                  Filesize

                                                                                                                                                  215KB

                                                                                                                                                  MD5

                                                                                                                                                  d79b35ccf8e6af6714eb612714349097

                                                                                                                                                  SHA1

                                                                                                                                                  eb3ccc9ed29830df42f3fd129951cb8b791aaf98

                                                                                                                                                  SHA256

                                                                                                                                                  c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

                                                                                                                                                  SHA512

                                                                                                                                                  f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  912B

                                                                                                                                                  MD5

                                                                                                                                                  484984b01e0713b1f8e0d010b904167e

                                                                                                                                                  SHA1

                                                                                                                                                  0df5d0fca161c3b7c554a4cd0b25afd980a0140b

                                                                                                                                                  SHA256

                                                                                                                                                  2ac9935b8bc3c5b1f90a349e8c08fc02cd227768014a1180316fc42a30247773

                                                                                                                                                  SHA512

                                                                                                                                                  2dd8334af383244417b7f865ccf69d9edad2f34d8caf439f1b5c7d63712b01006585cc595b595915c2928593ae7201473a025c2cdf9c83efc9cb2383bab91223

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  ccf792666fde09eaec5852f3d328ce46

                                                                                                                                                  SHA1

                                                                                                                                                  af8af807b0e737104c2abd25977022ae6b4475a2

                                                                                                                                                  SHA256

                                                                                                                                                  4660efcd2c59c79ad08bdd04a511d8ebc5fee832b972d00a40060d303de5314c

                                                                                                                                                  SHA512

                                                                                                                                                  2a5cdf9f37ac7daabdb6f8e2b76b434761c165806ac620df531c2cdcb63f85ddf5102a6ce77092ca6d8530ae25a838ac7763c7222e668dd21e3dc1427878b81f

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                  Filesize

                                                                                                                                                  2B

                                                                                                                                                  MD5

                                                                                                                                                  d751713988987e9331980363e24189ce

                                                                                                                                                  SHA1

                                                                                                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                  SHA256

                                                                                                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                  SHA512

                                                                                                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  859B

                                                                                                                                                  MD5

                                                                                                                                                  f8631dc888de6eaed761df5421d14a82

                                                                                                                                                  SHA1

                                                                                                                                                  180d7dc9edacd6ee0f01bc0d05f13d0ef3b234be

                                                                                                                                                  SHA256

                                                                                                                                                  998be4722eaa8e438ab2e2a10d77e12bd199c86235a762eb6673f22f805ef5c5

                                                                                                                                                  SHA512

                                                                                                                                                  c59c559cde1f042769f092d00eb790deda3df75046f63f1b1889716c78d91218c2998f2c378c97814dc8d3c3354ac8da084d4b537a1d547d22c8be6c0107617e

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  7af32c736d5c3c05dcff86fcad6f2e67

                                                                                                                                                  SHA1

                                                                                                                                                  1d2f787c0f92c5df0937c8e6936688205960115a

                                                                                                                                                  SHA256

                                                                                                                                                  cbf593419cc6c97eb4cca5b7af80e84a9a57d3b417dce235e86b61abb71bf8f1

                                                                                                                                                  SHA512

                                                                                                                                                  1de9cabfd69233e4c7c9319604af7af900605a4df3c4c6c9b675bfc497d51b5f2cfe81f72c002ede1d214c319130cc014ffceea788068d9113600a6c97f9f4d9

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT

                                                                                                                                                  Filesize

                                                                                                                                                  16B

                                                                                                                                                  MD5

                                                                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                                                                  SHA1

                                                                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                  SHA256

                                                                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                  SHA512

                                                                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                  Filesize

                                                                                                                                                  10KB

                                                                                                                                                  MD5

                                                                                                                                                  5729e235545a152787ccd8cdf4f8b613

                                                                                                                                                  SHA1

                                                                                                                                                  90f1e28ad2e07ccfb3c3df03f772ee9db2b88ce7

                                                                                                                                                  SHA256

                                                                                                                                                  62989f6ed3269101ca64f50a51c2d2271693edb2777acbdde7651bac9ccd066f

                                                                                                                                                  SHA512

                                                                                                                                                  2ad858ad2959e36c8f5e0d4b172eba3b3df613cee82da17a264ed7b31c9a5fe1d46220158ef57bc4de5b8b11ac98d88e7b2b2b3eead12b9d81d3ae77fced6e74

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                  Filesize

                                                                                                                                                  11KB

                                                                                                                                                  MD5

                                                                                                                                                  1e8ded96e8f4ef098e06184f00522aa4

                                                                                                                                                  SHA1

                                                                                                                                                  83383840d79aa2dd16e7e028026844ec215e424a

                                                                                                                                                  SHA256

                                                                                                                                                  0695fc877132020f04e16983c12531c2e6a47eb222bd759db540f946d12e3f72

                                                                                                                                                  SHA512

                                                                                                                                                  e48654662f4ac6f6ea1586107145a17699e906df3874ffff0a253953201fe45710e3918de75ee63023202e6ad609a52017282d037dd268e507ce613238a80d88

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\424c192c-ce60-4ea6-b692-d93b67e04b70\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  aa13935766ba7ad123215e58ac452f67

                                                                                                                                                  SHA1

                                                                                                                                                  f32e1e86bac483a3c2923ff7b50359c549c281f9

                                                                                                                                                  SHA256

                                                                                                                                                  f37c4332c9259f1701037116d1399150325736282d12b5e4041af270009e4125

                                                                                                                                                  SHA512

                                                                                                                                                  44689087519058795923302ad57736977b9a70e5c97a028ed58f5b66ab08a0975025d55e49878b44c09edb314d32b560ea0953704ae601dc9b3833324824c8cc

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\424c192c-ce60-4ea6-b692-d93b67e04b70\index-dir\the-real-index~RFe57c033.TMP

                                                                                                                                                  Filesize

                                                                                                                                                  48B

                                                                                                                                                  MD5

                                                                                                                                                  0a9a2e66bf286111b96c8176c706128c

                                                                                                                                                  SHA1

                                                                                                                                                  93548a964b3b906b4af323ece4e4cf5f02eb1a35

                                                                                                                                                  SHA256

                                                                                                                                                  bb87fb30c3edd68559c12abf6683873e9dbcfcb304dda86f6ed894f0e80af28c

                                                                                                                                                  SHA512

                                                                                                                                                  37b71c36dbc7f340c6de948674f8551833b7b4617aa682b57b37ffa408be5e62fed0381d9ec0772db0b439900b770a349ad62bf4607c56af3f9dc4fc9a36c481

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                  Filesize

                                                                                                                                                  176B

                                                                                                                                                  MD5

                                                                                                                                                  f379c406233e45136b7af8fe452efeda

                                                                                                                                                  SHA1

                                                                                                                                                  029fc932e0603722e6638eb38960390b8236a551

                                                                                                                                                  SHA256

                                                                                                                                                  a8fad8b588cf3e1a07f0700f4bff8d4d13ec5a85bdac6d13dadc525f18080f1f

                                                                                                                                                  SHA512

                                                                                                                                                  617582605f05e2132871f4b51059a914497e1badc32b3e0114f99019279121818662b547fdbeb11db50a5f62ead42cee8ced9cb807d8f33cf9a3eb602caa10af

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                  Filesize

                                                                                                                                                  114B

                                                                                                                                                  MD5

                                                                                                                                                  bbf85a3ef0a43325f292bfe9421d24a7

                                                                                                                                                  SHA1

                                                                                                                                                  85b6908ba30e358cb7d69d44335c6a4011979fa9

                                                                                                                                                  SHA256

                                                                                                                                                  b5d228cfc841f014ba79c28be137e2c2c8c4c580c6ff986f98b848b1d41d1b6d

                                                                                                                                                  SHA512

                                                                                                                                                  3b90ff1c6fd7be6fe3c2610d332ff1cc42438ef54bd943cedfa1d518efb2695f81258ccb3e4ed516370f24839b3ad6e24933a19dff88051e5e697ae5fc2a7c5f

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                                                  Filesize

                                                                                                                                                  112B

                                                                                                                                                  MD5

                                                                                                                                                  1e4b7b357829abb1f9b6985a8f0e725b

                                                                                                                                                  SHA1

                                                                                                                                                  e09f7dc38c656624db3134a4ce641347bc128763

                                                                                                                                                  SHA256

                                                                                                                                                  abe5ca1fcbac2d865cabf1883790204358390874aa432b81405f34b973c85ee9

                                                                                                                                                  SHA512

                                                                                                                                                  b56059467f09551af265c53027127645ec926a487779b0b2b32b84f471941f17d9026d06fcf897ef48e106f8306e13ced4069d69c745b804a5d28df176729ee2

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57b120.TMP

                                                                                                                                                  Filesize

                                                                                                                                                  119B

                                                                                                                                                  MD5

                                                                                                                                                  0c18d54554579905e6acd8d90207c6b8

                                                                                                                                                  SHA1

                                                                                                                                                  9ab376a8fa025f6fb4bc485c71e58e0f8d946b57

                                                                                                                                                  SHA256

                                                                                                                                                  90de242bb04312fcea0613ed14620c1b2647f1c6f89c4aa2c6c3d0d382d5859e

                                                                                                                                                  SHA512

                                                                                                                                                  84ebe43227f2bedc57c4dbc0271e90da16e32169cab8762edb89c978fe13554a960a652b2318c7e625135e1298234eb0cffb214bfddfacd1ca343f53fceb491f

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                                                  Filesize

                                                                                                                                                  72B

                                                                                                                                                  MD5

                                                                                                                                                  81f9854e96947b9622a3638dc8a35f0b

                                                                                                                                                  SHA1

                                                                                                                                                  2d67a6fe874284bfbf36a140a82623506d479aba

                                                                                                                                                  SHA256

                                                                                                                                                  b49e05f8a315b4e71b8569da2cd8b528110f22971dbd1957df47af9909a6b54e

                                                                                                                                                  SHA512

                                                                                                                                                  8d0d6d3e82af3f30f9ba31200edd478241f2a977cf8ff92f8df2b67552198b8d6daa8c37bf02cf6b8d3f186599552c5001d0dd2805c78012805694073b620f7a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png

                                                                                                                                                  Filesize

                                                                                                                                                  1001B

                                                                                                                                                  MD5

                                                                                                                                                  9b4d2aa85bae2b94477371dba6544b2a

                                                                                                                                                  SHA1

                                                                                                                                                  4dd2d97aa25b2723a91016ee5b403619e7a4eb99

                                                                                                                                                  SHA256

                                                                                                                                                  3af45701fd97bc8ae6ae8e9f999d5d8b9d61a9a7914faf6518450f454e884223

                                                                                                                                                  SHA512

                                                                                                                                                  f6351c370d91a87a2b0abd8da8460e65a8149700beff2e819074004101133e750b1e60ecdf6ead73d1de19f37258e7853084d65c6adfeab8707c480d9caabc93

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4784_1070749296\Shortcuts Menu Icons\Monochrome\0\512.png

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  206fd9669027c437a36fbf7d73657db7

                                                                                                                                                  SHA1

                                                                                                                                                  8dee68de4deac72e86bbb28b8e5a915df3b5f3a5

                                                                                                                                                  SHA256

                                                                                                                                                  0d17a989f42bc129aca8e755871a7025acb6292ce06ca2437e95bedbc328fa18

                                                                                                                                                  SHA512

                                                                                                                                                  2c89878ec8466edf1f214d918aefc6a9b3de46d06ffacff4fdb85566560e94068601b1e4377d9d2eabefdc1c7f09eb46b00cf4545e377cc84a69edf8e57e48b2

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4784_1070749296\Shortcuts Menu Icons\Monochrome\1\512.png

                                                                                                                                                  Filesize

                                                                                                                                                  10KB

                                                                                                                                                  MD5

                                                                                                                                                  529a0ad2f85dff6370e98e206ecb6ef9

                                                                                                                                                  SHA1

                                                                                                                                                  7a4ff97f02962afeca94f1815168f41ba54b0691

                                                                                                                                                  SHA256

                                                                                                                                                  31db550eb9c0d9afd316dc85cdfd832510e2c48e7d37d4a610c175667a4599c6

                                                                                                                                                  SHA512

                                                                                                                                                  d00e2d741a0a6321c92a4aab632f8f3bafd33c0e2875f37868e195ed5e7200a647b4c83358edcef5fc7acbc5c57f70410903f39eac76e23e88a342ac5c9c21cd

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4784_609650724\Icons Monochrome\16.png

                                                                                                                                                  Filesize

                                                                                                                                                  214B

                                                                                                                                                  MD5

                                                                                                                                                  1b3a4d1adc56ac66cd8b46c98f33e41b

                                                                                                                                                  SHA1

                                                                                                                                                  de87dc114f12e1865922f89ebc127966b0b9a1b7

                                                                                                                                                  SHA256

                                                                                                                                                  0fb35eacb91ab06f09431370f330ba290725119417f166facaf5f134499978bd

                                                                                                                                                  SHA512

                                                                                                                                                  ce89a67b088bae8dcd763f9a9b3655ed90485b24646d93de44533744dfcf947c96571e252d1ad80bdec1530ff2b72b012e8fff7178f1b4e957090f0f4c959e0d

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  228KB

                                                                                                                                                  MD5

                                                                                                                                                  e12b67bcf4902ac2470d76d887b51600

                                                                                                                                                  SHA1

                                                                                                                                                  8072ac49c1305fac7858aebe30fa26fe1f16d286

                                                                                                                                                  SHA256

                                                                                                                                                  70bae80e7674f38de503fa05d1b7f8c2e860f61c2893e8d4c3c317939a349e75

                                                                                                                                                  SHA512

                                                                                                                                                  1504e2a91f9bd474cc7190fb6f594b0247a7afa4558470ed53e596cf62b0de319dab91beefefdab7773915691ac6371553e84762725fb034037268302b3bdc13

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                  Filesize

                                                                                                                                                  228KB

                                                                                                                                                  MD5

                                                                                                                                                  7098df109ced75fe0d65b184c0109bb4

                                                                                                                                                  SHA1

                                                                                                                                                  6e87bda15a5a5918ad363feaadba9d16e7f494b5

                                                                                                                                                  SHA256

                                                                                                                                                  b63cd0dd17dd558e0a09265f4ba0ba03b0fb485d1f0316ca290cb73cde880bf8

                                                                                                                                                  SHA512

                                                                                                                                                  2d674ee320f36ae6a440ffcf524f9bee5c91a2fd40276b64bb21b3ebb5cef167240835b069970d5bb764d63b8b941da5ce18ee2ed998480ee7e70073392dc12d

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                                                                                                                  Filesize

                                                                                                                                                  264KB

                                                                                                                                                  MD5

                                                                                                                                                  f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                                  SHA1

                                                                                                                                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                                  SHA256

                                                                                                                                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                                  SHA512

                                                                                                                                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

                                                                                                                                                  Filesize

                                                                                                                                                  14KB

                                                                                                                                                  MD5

                                                                                                                                                  9c5ee2406af8faaa51152e311f194fff

                                                                                                                                                  SHA1

                                                                                                                                                  86c400adbbaef2d6b47d482436ec7334f0813197

                                                                                                                                                  SHA256

                                                                                                                                                  83779c4a5ff7a1f431a70fbadb6ae4661e19bd3b5c032e5e62ecc7afd7feea8d

                                                                                                                                                  SHA512

                                                                                                                                                  f3d643f34b1a8ae195994963eab00ff4fa8a7468f5874ef0531b87d1e05e226f9163c82cede6b581aef3a71cdb094f37455e9c15f67ec318902e7b3c16015526

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Decryptfiles.txt

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  MD5

                                                                                                                                                  6cff894eb7d2516e715eea6dce359798

                                                                                                                                                  SHA1

                                                                                                                                                  f524ee36bc63c993f111b3ef5eba450289a837cf

                                                                                                                                                  SHA256

                                                                                                                                                  a4b0bd9477d4a08f0cb57eadd98f4de77b674022e6fca5902f07d730a444757d

                                                                                                                                                  SHA512

                                                                                                                                                  1431e08dac69e3b10845166a5cec9d0010d92bce72bd97a2f8f249d65e6e5eee55a6575f58f1d1a308e8a9a133665cc9b7c11585d8f6a11434da636451dad6a6

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\f4aa015f-b91f-4f73-a190-00d176fa056a.tmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.4MB

                                                                                                                                                  MD5

                                                                                                                                                  0057df233fc9040968509a1de13086d8

                                                                                                                                                  SHA1

                                                                                                                                                  217678d8a692efa2661a47d93cd0019587ae95d8

                                                                                                                                                  SHA256

                                                                                                                                                  735081b6beb30a6312137ca5e2ae73dddd23fe091d9f8c6a84e15eaf0d1a4e2d

                                                                                                                                                  SHA512

                                                                                                                                                  0d934454f2fdb6df0df49e23f42940ca85649c843e3a3360461a07e5d4970ae49468f2adb5754d4e3ab6be517eca0f3638f26d4d09f63dc08b7bc30468992a43

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Brave.lnk

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  dcf40a1bf38d1671cdd6a944898f8242

                                                                                                                                                  SHA1

                                                                                                                                                  89c88dfad2140fcaaf0aa9b60e15836734cfc9d9

                                                                                                                                                  SHA256

                                                                                                                                                  77b95782caac624c427fb01ea05a4ae4f82a42b88bc615f3106ed351dcf61dd5

                                                                                                                                                  SHA512

                                                                                                                                                  43557e4dc834efad97c7341d91183b3a3fd0ea8bb55e80a3a711d5d65cd67255a8d9563f2bf68feb0996fb46845dd5fa118ce956b41ac81769ffad99208a39ee

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

                                                                                                                                                  Filesize

                                                                                                                                                  10KB

                                                                                                                                                  MD5

                                                                                                                                                  5f400a89aebe6a9929021c48203dd3ff

                                                                                                                                                  SHA1

                                                                                                                                                  759bce2fcad2faa6342d69915e72c994c6f86dc1

                                                                                                                                                  SHA256

                                                                                                                                                  0c53f78bfc373dba8afda59c408b2972f9062e0af1ba6c2e2bb2bf5a07ff8f83

                                                                                                                                                  SHA512

                                                                                                                                                  2e52c78b9d47141d912043eeb70a7289e39adc64585438e2913b5e7f2fd7b4262dfb15f97a553e104eee477c713cd03d50c1348804486eb9a1c309a3511d7180

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

                                                                                                                                                  Filesize

                                                                                                                                                  5KB

                                                                                                                                                  MD5

                                                                                                                                                  55eecdae9a3405cd06d66d563ae0b840

                                                                                                                                                  SHA1

                                                                                                                                                  c27d040cb05d38c9736b5a7397bd4dad57fd200d

                                                                                                                                                  SHA256

                                                                                                                                                  1464a751830b842f99b0163d57bb4561b6ed34e2cdad1d8c8f432ca24db53df4

                                                                                                                                                  SHA512

                                                                                                                                                  b3cc377624cc5c662e971c870b19c6b54a128909e42ba26c2d0493f6c07a6742c6c585cd563053b3d8c71d70292463b89a5df6ef3ff767a9705cb8397ee1bcd6

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms

                                                                                                                                                  Filesize

                                                                                                                                                  10KB

                                                                                                                                                  MD5

                                                                                                                                                  097ef6182b5d032a13d717c0564f9b1d

                                                                                                                                                  SHA1

                                                                                                                                                  ad802c27acded167e9ea30afab410dbfbcc25d19

                                                                                                                                                  SHA256

                                                                                                                                                  a3c1c7582dbf86385042a977b863fd1da5b9d2b4813ca710b317072ef3fce2d5

                                                                                                                                                  SHA512

                                                                                                                                                  2489cc425a0315f666f4cf999e56569f7cd180072c83b171542bda4e28140a83d477bce7d065086da5d0b79ab9d443b9516c034d054f785965f21893271be1d5

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  9de32ff1c05cd91fe98ae10a79dcaf18

                                                                                                                                                  SHA1

                                                                                                                                                  7d76f8bd9f446e8b3a4e955243166e108d74c3d6

                                                                                                                                                  SHA256

                                                                                                                                                  c90af3eee33cd813b483f7bee3526184880f1f6f3c03828529e37c985ccebd84

                                                                                                                                                  SHA512

                                                                                                                                                  38ad74ae9fe065bf46c10e72b4d54fe78c72be3ac45de500c0253be940f30d02404544baff30d902327ca83df7cf200a3549e91538465ba49ab09a38efedf899

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms

                                                                                                                                                  Filesize

                                                                                                                                                  9KB

                                                                                                                                                  MD5

                                                                                                                                                  dd203ee355ddbdc770a4df53ca67efea

                                                                                                                                                  SHA1

                                                                                                                                                  da4af621d726f1a6d4c3170287f2d257dffa3de2

                                                                                                                                                  SHA256

                                                                                                                                                  7ee79eee9d54f1da2f2f5b0ee1d622fe20550df59b04dee0b133fa970228e200

                                                                                                                                                  SHA512

                                                                                                                                                  e7ba2734ba8910ddfdd53573c4563889c5ace299f00401e8e18d6ef76ec9217a4345541ffeb0bd0447fe6b3e88b99308b5441a611754814068380ecaf47db3c4

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms

                                                                                                                                                  Filesize

                                                                                                                                                  9KB

                                                                                                                                                  MD5

                                                                                                                                                  5e576cbc8557792f0a5dc1ef07b6eb0d

                                                                                                                                                  SHA1

                                                                                                                                                  c187ff0c518232c08c61a63e99a7def52b48548b

                                                                                                                                                  SHA256

                                                                                                                                                  ef682b4a8fc2257afa96d316667a4646011724151d112b48539e0c14d23d4c9e

                                                                                                                                                  SHA512

                                                                                                                                                  aba016469177c767c41bfe358907c27a7c4d8fb8e0badbb1c49061b27bb3c47d5919bf110f7e4892f3f401b5d14d9f67e86ce1cb874e3121338367ef68e71ad3

                                                                                                                                                • C:\Users\Admin\Desktop\Unconfirmed 135658.crdownload

                                                                                                                                                  Filesize

                                                                                                                                                  22.5MB

                                                                                                                                                  MD5

                                                                                                                                                  0ba9bddf58c9d7763f63442efb6e30af

                                                                                                                                                  SHA1

                                                                                                                                                  a5e8f717ee437118a36cde1e2d26e8dad4169622

                                                                                                                                                  SHA256

                                                                                                                                                  32fe98a9a77a656afb7dd3c39b6cad1ac5222c2fc9313a8aba6ae8546f244371

                                                                                                                                                  SHA512

                                                                                                                                                  a5637ad57f8b52ae2523d5443db9bc6255bd05e563b47a3f88903624751d1913b23b52c000cca93436b65876391da797bd25211c27027917864ac394b67c1298

                                                                                                                                                • C:\Users\Admin\Desktop\Unconfirmed 251807.crdownload

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                  MD5

                                                                                                                                                  d4a776ea55e24d3124a6e0759fb0ac44

                                                                                                                                                  SHA1

                                                                                                                                                  f5932d234baccc992ca910ff12044e8965229852

                                                                                                                                                  SHA256

                                                                                                                                                  7ef4d0236c81894178a6cfc6c27920217bea42a3602ad7a6002834718ba7b93c

                                                                                                                                                  SHA512

                                                                                                                                                  ba9127f7f84e55a37e4eb1dc1a50d10ef044f0b24a23d451187c8d1dedec26d3a37cf78e8763b351ef1e492e26b1ef9b28fc2331591ce1b53c3d76369d100f4b

                                                                                                                                                • C:\Users\Admin\Desktop\Unconfirmed 399242.crdownload

                                                                                                                                                  Filesize

                                                                                                                                                  3.9MB

                                                                                                                                                  MD5

                                                                                                                                                  307b6a325777d94923f662b3ec2cab6c

                                                                                                                                                  SHA1

                                                                                                                                                  3c4aca619fb5fdf62635a903250c563a56a696c2

                                                                                                                                                  SHA256

                                                                                                                                                  95838246a5303886567ad9ceed1a83b741de848a3a1b110be0ae98c9f51e3121

                                                                                                                                                  SHA512

                                                                                                                                                  2444ebc8b2429b3aee66507d6f5750ba994eaa24b23765ffe7b6a4316faf5b20c9a8730875b38ee3a65828463217f8dce9655a6df58a0fd7e7c6860f881e6421

                                                                                                                                                • C:\Users\Admin\Desktop\Unconfirmed 403968.crdownload

                                                                                                                                                  Filesize

                                                                                                                                                  871KB

                                                                                                                                                  MD5

                                                                                                                                                  2d2c7ee748d941798466b19b53da88bb

                                                                                                                                                  SHA1

                                                                                                                                                  7c0cf86f123f2896795add3ecc7bafc30fdc87bc

                                                                                                                                                  SHA256

                                                                                                                                                  066dc9a1134b1db77c1574a52002f53b28cc29d0a3769bd5156d1e0e0a51a91a

                                                                                                                                                  SHA512

                                                                                                                                                  9f5a9b6ce25222219f6ef07ac85e5fdf834215dcac81006629b21667aeb4ef9a809e336a66ead9fdcde0af8f51fa7d459b4875bf4023d6cee1eb189eba341912

                                                                                                                                                • C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe:Zone.Identifier

                                                                                                                                                  Filesize

                                                                                                                                                  26B

                                                                                                                                                  MD5

                                                                                                                                                  fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                                                                  SHA1

                                                                                                                                                  d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                                                                  SHA256

                                                                                                                                                  eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                                                                  SHA512

                                                                                                                                                  aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 106654.crdownload

                                                                                                                                                  Filesize

                                                                                                                                                  1.2MB

                                                                                                                                                  MD5

                                                                                                                                                  06f058eee50645758a81e8842353f372

                                                                                                                                                  SHA1

                                                                                                                                                  15e9010bab33f1733ea41b7c45d2da5d74ed721b

                                                                                                                                                  SHA256

                                                                                                                                                  854d06a90dab54e7b69882925886fb24be711fdc21884e13c77e29048b21a098

                                                                                                                                                  SHA512

                                                                                                                                                  920d5b6b902a742551dd0003c3feab430c3648a36850ceecc33f5baee365bf3f938420f80695618e1ef604daf3e215112938a57f3a7f6420c286ec430e89d817

                                                                                                                                                • C:\Windows\Installer\e5e5801.msi

                                                                                                                                                  Filesize

                                                                                                                                                  2.1MB

                                                                                                                                                  MD5

                                                                                                                                                  04381cf1f12960ae2d748820670c4337

                                                                                                                                                  SHA1

                                                                                                                                                  69a4cf6ef4871644fc7eeaae4720e0d8275a215c

                                                                                                                                                  SHA256

                                                                                                                                                  e82143029872c041297ec16187e17bb835504d8ee0e7baae9cdb413cd8480421

                                                                                                                                                  SHA512

                                                                                                                                                  b115a10a60321b691bb60c7d257ce528b7b294cec07eec9e2bd0fd623f4762020c7ce3cbc51483dc35af3a1e552e5ca8e83f9e509caa9fd43f0c4f30719135a5

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\BraveCrashHandler.exe

                                                                                                                                                  Filesize

                                                                                                                                                  270KB

                                                                                                                                                  MD5

                                                                                                                                                  1215366af12337d0c6df30cf1e8d8703

                                                                                                                                                  SHA1

                                                                                                                                                  c068c7c67c7940a8b54f91878a41d7d563b89b52

                                                                                                                                                  SHA256

                                                                                                                                                  afc14e01f32986b8fdf70abedf20a4fa4f8617197164eda2486e81960a4c82fd

                                                                                                                                                  SHA512

                                                                                                                                                  159f94185a34d0f7eda4bcd7a3428a47df7bd380908a3cd2e8f3793740e2be683637279f248c78ba919e2e9eab7f1196ab6e1c3f090e51ff0b84d5e152e613fb

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\BraveCrashHandler64.exe

                                                                                                                                                  Filesize

                                                                                                                                                  355KB

                                                                                                                                                  MD5

                                                                                                                                                  57a36d4a82d48dec0b84dbead5af407a

                                                                                                                                                  SHA1

                                                                                                                                                  09fb2a73be8171a3d0e4fe8202c8b5aa8e0c662e

                                                                                                                                                  SHA256

                                                                                                                                                  688fc87c2c8659b03a4e356b2e0d60d644b4f91865afde2edd0b431fe3e9ce6d

                                                                                                                                                  SHA512

                                                                                                                                                  35cce78ec9b0fef3836b543f3737f71403cdf8d4b084f37276dd9eec63dcc958ea2e64197a09dda9bb85c69654b5d9d65992f7509c9ae542786e49867102a0c8

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\BraveCrashHandlerArm64.exe

                                                                                                                                                  Filesize

                                                                                                                                                  353KB

                                                                                                                                                  MD5

                                                                                                                                                  e2c7fc3a842c66f204a71680ea65be48

                                                                                                                                                  SHA1

                                                                                                                                                  9770bd0b297be216651330f5dada585bb9ab7280

                                                                                                                                                  SHA256

                                                                                                                                                  024e34c8d8ec714e98a82a6df2de2252f2e0028f91b3ccc928f53498179a7ca2

                                                                                                                                                  SHA512

                                                                                                                                                  5549a1478cd09cd00525d56dd4b162a3d42a1284c9f811037f02c6c0aed6094e6be53f7580b62226cc9eb31b8b5048435e6225ead7de996c4f3480f5852c7089

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\BraveUpdate.exe

                                                                                                                                                  Filesize

                                                                                                                                                  163KB

                                                                                                                                                  MD5

                                                                                                                                                  ee743bc7055cd46c5dc436c2e31fbb2f

                                                                                                                                                  SHA1

                                                                                                                                                  bc2ecc65e2de6095306d752ad8d4005c0abf0a95

                                                                                                                                                  SHA256

                                                                                                                                                  fb5355f32b99974fcce4eeaf47eb285b7a5eeed743389ef86cd781227885f7de

                                                                                                                                                  SHA512

                                                                                                                                                  de549940080e22134a462061b05c19b71224f99d88748e161626c15c10b0e6dde73f614d2b73e7c667883669ef073da249066bda7344e8832f2db3f4ca771b53

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\BraveUpdateComRegisterShell64.exe

                                                                                                                                                  Filesize

                                                                                                                                                  170KB

                                                                                                                                                  MD5

                                                                                                                                                  0ab8bc5e7781d4d8adf8e9042a092b01

                                                                                                                                                  SHA1

                                                                                                                                                  55b8f5c9eb6569684d3dcd5a9eaf307c130a9096

                                                                                                                                                  SHA256

                                                                                                                                                  413516c1b9256ac6091789ab02ee8374720a8e4d3e4ff02f9dccbed707e1d5e3

                                                                                                                                                  SHA512

                                                                                                                                                  0e2e3c94f7d2c7c7ee7ee8894b97e7d45fec8869ff31a6202b2316a5122570036455b4a6dfb9419c7d21d3dcc90f92bb5297b4e964469ea656b4aec82bc25226

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\BraveUpdateComRegisterShellArm64.exe

                                                                                                                                                  Filesize

                                                                                                                                                  154KB

                                                                                                                                                  MD5

                                                                                                                                                  d0ac42d1758fd7d7c358ad2afce07b01

                                                                                                                                                  SHA1

                                                                                                                                                  6714c0c29fc240f6173baaf61876836bad18ca9e

                                                                                                                                                  SHA256

                                                                                                                                                  35dff5c835b1e56f004fd744c2e9c66495130bf8de1a35bb216fdd21d012d12d

                                                                                                                                                  SHA512

                                                                                                                                                  e2f27b1c4463de2046b3dbb8dd0cc489ad591bdb0be2b566e1bb909c6409cb333da3905f3239a45560aaebb3ae0760dd12854b6ea1d48ec43fd2d037bcaa67bd

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\BraveUpdateCore.exe

                                                                                                                                                  Filesize

                                                                                                                                                  195KB

                                                                                                                                                  MD5

                                                                                                                                                  bbcf651a95a8ef4de64e68aae60739ca

                                                                                                                                                  SHA1

                                                                                                                                                  63c219727f867525ce1f3bec122117427ab17e74

                                                                                                                                                  SHA256

                                                                                                                                                  fc081f3cbae71ad895f77ee661b8eb8d6adb7f7652ef072572f83a21024f3e52

                                                                                                                                                  SHA512

                                                                                                                                                  e77bda759b5330a4084d1904273af243bf3667058eb71494f29413e0ce05dd2800eca3b6046d577a648c9e4f9c582b0b88e07312b9ef0cbc30b1732f2a371856

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdate.dll

                                                                                                                                                  Filesize

                                                                                                                                                  1.0MB

                                                                                                                                                  MD5

                                                                                                                                                  371ca63d32e87dc52fbeb61e32f0b5ad

                                                                                                                                                  SHA1

                                                                                                                                                  ac6a727a473c6e86a940ffe5b2e159f643f14c8b

                                                                                                                                                  SHA256

                                                                                                                                                  509d0da97daf68177e9ac67768bdc249069e6c524d016546413df78f96ca5b71

                                                                                                                                                  SHA512

                                                                                                                                                  3273ba366d91288cfff6dcdac96f320048bb0e9eb6b721b40aa97396e04902d7d9cd3b5374314a7cad06ae1622f6de83189ce0947b6de97771f2651c3cd5f275

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_am.dll

                                                                                                                                                  Filesize

                                                                                                                                                  42KB

                                                                                                                                                  MD5

                                                                                                                                                  44f5b5915e90e0ea92230935ffdb387a

                                                                                                                                                  SHA1

                                                                                                                                                  dc8a855da4ce00d1e7fe6666ec5517f1b9251d46

                                                                                                                                                  SHA256

                                                                                                                                                  b424c70cde21c207c7a0ce50c528a07916f3a23e729662399005a9c2101a4572

                                                                                                                                                  SHA512

                                                                                                                                                  802100300f9227aae6e2a68c88bb8ce898f54ffeb5a1291e793fb05e8dd5eefba43cf0d8ce6729e3e2b96b8877703ef96e75ccad4bf7b7104b3c4ad98e9fb520

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_ar.dll

                                                                                                                                                  Filesize

                                                                                                                                                  41KB

                                                                                                                                                  MD5

                                                                                                                                                  9f4fd820285020cf27e98e887a86b371

                                                                                                                                                  SHA1

                                                                                                                                                  d02a83746eafea50bfab3f2c376dbc7065901e6a

                                                                                                                                                  SHA256

                                                                                                                                                  0211e33039e643716dae115bbaa7fe48712ffce05c5cd93e430f0920944dc0a7

                                                                                                                                                  SHA512

                                                                                                                                                  f2a2e58f59878ef0a0da39f55c49eab2252d1a239a2b528e5f24141c9624ba70c7a0b116b5f7260d7642fb639ea6b02267a86d87d80b7040f01a3f77b2d30df6

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_bg.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  a1d35e34f46dac72a6d9828fc684342e

                                                                                                                                                  SHA1

                                                                                                                                                  11e8620b430713d2a060e8b00885406406999ff5

                                                                                                                                                  SHA256

                                                                                                                                                  ecde99e60a06439b6efe56449b574e4e3c72bd2866435057ea96bd95a37475b2

                                                                                                                                                  SHA512

                                                                                                                                                  f3e4fca639692c375c6bc5da8add571d0321a96b108ec4b5c8c066fcd66dbc03d13466e1ee2a6999c8a3295d4dbab196e4201676d33baf23c0d7e1910005e086

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_bn.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  d2f9b8a15531dbc23062d36a32f2785a

                                                                                                                                                  SHA1

                                                                                                                                                  fb91c68d9169e3395d08a9e0d9206ab9eeb4a9bf

                                                                                                                                                  SHA256

                                                                                                                                                  745a678f24bc4bb23fee635f7208da54c611c4dbaf3d6ced8ce506e6fcbdfb33

                                                                                                                                                  SHA512

                                                                                                                                                  71cb4fd02e23f9f5ebc07b78073b33d22ad2d0f63577cb60f38b42af1da451b1738f77edfa2c77696963ffcd09d3eaf07feb69814ac20b43c65bc71b720842b3

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_ca.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  c6c28c37de5679872165d8081eaae611

                                                                                                                                                  SHA1

                                                                                                                                                  a6314c35d35abe6da7cc21a0cb3b3ae6cb8cd868

                                                                                                                                                  SHA256

                                                                                                                                                  b6569295bbb95a2b7ef2a203cb2e6328f57afdb60d2eed7c91b9e0c140492f89

                                                                                                                                                  SHA512

                                                                                                                                                  d8ebcc4edfbbba20e481e02a1abf8d135c0028abe6afd05b67748175b2683da5a22b31c19251180072e2daebf3b8ad1006d07973432844e97fab7fb141e00bd6

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_cs.dll

                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  5f1801d5a4313f38b0afe77780ff418e

                                                                                                                                                  SHA1

                                                                                                                                                  9260d0bf49fac341682e26bf333d90a02a9fd383

                                                                                                                                                  SHA256

                                                                                                                                                  f220083e8127200342cc2a8b441a711f4b08fca1c0bad08f71e65fc755fd5903

                                                                                                                                                  SHA512

                                                                                                                                                  833bfaa2a1c106492878e36f455dbccb592686168dc9692311423c73b9f09b3ab0df67c4248be529e72fa27bfdb1ebbeb16a3dd5d5ff56fdc29ef0f7c8511101

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_da.dll

                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  9d31f68f685b47a909056410e13d9b67

                                                                                                                                                  SHA1

                                                                                                                                                  ab65cf05a95d8bbc3fe4e4dcd4c5e67cd1082e4d

                                                                                                                                                  SHA256

                                                                                                                                                  81891dbea99c47f2590259ce9b5a3fda7a80b7e9305dda387b2f6447eee7175b

                                                                                                                                                  SHA512

                                                                                                                                                  aa7ea8c086b59690eb3ac7a2e334aaaf83e0cc1b3adbbac53b2ba04cff67392ac87d175a88ddbf5c7b53f874fda203b5360494bf628b0c563e7953dc11553907

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_de.dll

                                                                                                                                                  Filesize

                                                                                                                                                  45KB

                                                                                                                                                  MD5

                                                                                                                                                  c699c7cdf4be1ddd44b093e1f6ccd4ce

                                                                                                                                                  SHA1

                                                                                                                                                  23976f3f86117d4942e3d4010d8a2944615275c2

                                                                                                                                                  SHA256

                                                                                                                                                  f8f33f39f47c9bd53ac6497cdb2c7e10b4f5aebf70dbe5c8422162047730c727

                                                                                                                                                  SHA512

                                                                                                                                                  930a757630dde8659a0d3dbe8c09ddcc2d7c5295809e22e1c071b8a6e83feb9a88c66131c9d889c51636b8daa68c06ebcf32c935626fda2a5ab7630e16309f26

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_el.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  638491d6e7411ff991caf3593ba96bca

                                                                                                                                                  SHA1

                                                                                                                                                  14e6fb5ad4a66800fd56be8d0f2bceaeb765eaa7

                                                                                                                                                  SHA256

                                                                                                                                                  964614d4e55cc2c61962777e23509aaeafcd3d78939aa148974a4b2fa574487e

                                                                                                                                                  SHA512

                                                                                                                                                  245de32e72c3701cf58d4260931d4450d4bcb204c72bfc92ffc37a06c00bdb95e9231d86c47da1e2927c8ec4f4ff4fc8a2948a741729a2276f3d3fc7f48250ec

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_en-GB.dll

                                                                                                                                                  Filesize

                                                                                                                                                  42KB

                                                                                                                                                  MD5

                                                                                                                                                  1731e2a7c6613805d563ce6dbd7029e2

                                                                                                                                                  SHA1

                                                                                                                                                  855a96774de85edb2d42ed62f4a930389020d1e2

                                                                                                                                                  SHA256

                                                                                                                                                  b52ba05b0a6b87b62544b68cba8790c5d823baf93da0fff65696f3def0e02be0

                                                                                                                                                  SHA512

                                                                                                                                                  9b846e535e86c2e023806235ae78ed4f68a984bf4c3c3d8779232a88dba449ad0484003b2c2563cd89bb9e022c2a3068fab90e4890614bc6f75d4847738028cb

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_en.dll

                                                                                                                                                  Filesize

                                                                                                                                                  42KB

                                                                                                                                                  MD5

                                                                                                                                                  1bbccbbbeafa25d677e1accf13fc7e91

                                                                                                                                                  SHA1

                                                                                                                                                  522cba760d745a78f9d2b1af43431b749ba525dd

                                                                                                                                                  SHA256

                                                                                                                                                  8dad4dfdddb975321556a1f1b398459dac6d68d6b29ea05e96d280b256cf0109

                                                                                                                                                  SHA512

                                                                                                                                                  f06b803b293a7a3e4b435a741179ccc64b41818a890a62d75dde459667c58db17b4b3a24529a654a64322777941218885a2b6e7b72e6e334386c1dfc20d0da38

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_es-419.dll

                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  6320127c77432434e44a89e93e2a5dd7

                                                                                                                                                  SHA1

                                                                                                                                                  44ed93983ee3fff1cf36b12d46450106429f6174

                                                                                                                                                  SHA256

                                                                                                                                                  4a02176ad398ba84f2420249e5a6afacb6bad12fcc810394d476d149bf889619

                                                                                                                                                  SHA512

                                                                                                                                                  a386719934fd85b6b1d7fa5c85e5214b29d5d6daa8853096ae60c41c2f99b87fa4518406d4d6fe942bb04f650aadcf905501dd0e41eb614ab11038a12026a707

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_es.dll

                                                                                                                                                  Filesize

                                                                                                                                                  45KB

                                                                                                                                                  MD5

                                                                                                                                                  8ca90163b756e2703eb5f92e520d4ffc

                                                                                                                                                  SHA1

                                                                                                                                                  1b6b24a5b2cca36c90669add9c0a0104df8aec86

                                                                                                                                                  SHA256

                                                                                                                                                  ac60eece8c5458a6110eba9fe47f703828da5999408a5e9c9c689365c6e4eef3

                                                                                                                                                  SHA512

                                                                                                                                                  0a38c7b95b8cfc8d17de80da77af898c395cc709a207787bda6e29681357d4c160ef11fcf80adb08558866872f34a525fd2b737f7d640d8e936cce48da8f4505

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_et.dll

                                                                                                                                                  Filesize

                                                                                                                                                  42KB

                                                                                                                                                  MD5

                                                                                                                                                  1ca6f5c39615ef0f16976a34a47d48aa

                                                                                                                                                  SHA1

                                                                                                                                                  f3983a754f6c8e857829b613d08d726b5a3de59a

                                                                                                                                                  SHA256

                                                                                                                                                  49821ddc2d2af2d21fb9cd7747c618f6ce9b8fb69e110dac017b4d41ad0bddf9

                                                                                                                                                  SHA512

                                                                                                                                                  715acb72219bea384115419f822290f145c89dcd35d2d5a14d14890aeb22640866806da9b01f5e6e0778fa982283481325d5d8ffa91933a976fe889c78222c73

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_fa.dll

                                                                                                                                                  Filesize

                                                                                                                                                  42KB

                                                                                                                                                  MD5

                                                                                                                                                  92e7886205eb3792cbbd3633a183cb12

                                                                                                                                                  SHA1

                                                                                                                                                  216564647a07115d839c885770d1c360475279a6

                                                                                                                                                  SHA256

                                                                                                                                                  2b630895ba3b973a2b1264c715b6744c277ff55031aefd4c26dc9d2360a3357a

                                                                                                                                                  SHA512

                                                                                                                                                  8d1a294fa164265de6621586efba9ee775c2819d662837cb3675c4335a106db74fb8fb1758ae5bfd9c78dc799590656018a20d4448ebf2077cbe2b266f73a776

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_fi.dll

                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  e45b0c0b274f1aa93d559590998c572e

                                                                                                                                                  SHA1

                                                                                                                                                  10f6e82ba3c00e5435b447bffdf7bf9ce48ba263

                                                                                                                                                  SHA256

                                                                                                                                                  dc0a8ce05108eff46fa2a5cd629d23693c826dcff45eb86e31c4ce163fa9a465

                                                                                                                                                  SHA512

                                                                                                                                                  1edf3cd05eb01a9317434218fca95839cfc5147c8d11c69a0d5c9228340e2c558fd3006b8daa821bcea20d54b2c7ecb088225ae14f8b380a4ccb43482e048136

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_fil.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  56cc233b80def41a589fbd52fb36626f

                                                                                                                                                  SHA1

                                                                                                                                                  70bf16bd33e95cfb894075c5d5ad30c3f9d39bf8

                                                                                                                                                  SHA256

                                                                                                                                                  864ceeb444e065766fb0b7f0ba4938e6f56ea6fda8a62c9530657abb7fc2fa78

                                                                                                                                                  SHA512

                                                                                                                                                  290fd8a5b39c8675d3d41bad0cab7410445a30adef62591d26a5da03723f86486468e3eee95926f0788fbb7959347f0e4c0db76ce7a78a22cac01817b7c44e11

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_fr.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  7b2bf17744445d49d1b61fe75d83e14e

                                                                                                                                                  SHA1

                                                                                                                                                  5402f1f0957f844420483ea3754807c4cb2cde86

                                                                                                                                                  SHA256

                                                                                                                                                  44d264d2654c059b777bcd7d011024b8104c028556e2dc9cc470a80d5f3a1f9b

                                                                                                                                                  SHA512

                                                                                                                                                  1b79e79168f9c1af4e736b5996c64f10fc8dc78960ebe9163b34230a11e0c9bdc58a799d963fcf31bcf87fec433e8abe88ba3f0ed01a6ea8e1f132f296bacd5d

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_gu.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  d3150bd7fa51c9aba84a2fc43c440983

                                                                                                                                                  SHA1

                                                                                                                                                  905c95de9153b94c4907230f16def4b214fe0385

                                                                                                                                                  SHA256

                                                                                                                                                  7adfd3b65531abf14f74b5d72ae29d5baefe44d0d2ea2991f6e4c949da088a67

                                                                                                                                                  SHA512

                                                                                                                                                  02bc2fc52ab74f0cb46e436570a5c099d5295b587a9952d1aa6f5e28c79b1a19d1245e05229ad5af568875d53ad2700dd97ae9a97d95d7869a4180f63da094d0

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_hi.dll

                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  bcb8e81f1363784b2c47ca4c8643219f

                                                                                                                                                  SHA1

                                                                                                                                                  9244c30660b017edda9d3387edcfeec25875b3e5

                                                                                                                                                  SHA256

                                                                                                                                                  545c1d69d3f9b1b512812dea31ad890ba95feb4ca3bbbdb98ce72a801919d116

                                                                                                                                                  SHA512

                                                                                                                                                  463c77b2daaaa30a0a3260eef19068da3f6e0c2d0099d628f72d12b5e49b69ff93d48bf3fb130bddf415b5941f89d2815afc5d917bb4df39f69adebdbe59bf09

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_hr.dll

                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  f6c25c1a214bb598f111cf4fa8b3400f

                                                                                                                                                  SHA1

                                                                                                                                                  315786decee66575abb87c1cb23af2dd46baa0a1

                                                                                                                                                  SHA256

                                                                                                                                                  a584889f453cfa9e8f9e03aa91187a00b2b1fc47161835bffa1f88423e293c3d

                                                                                                                                                  SHA512

                                                                                                                                                  f5c1c8f31c9bacfab4c91ec22429f202649012aad200078ceaf207b001cefa452c5ee75b02ff076b980d4cd25fe675447ab09a61b648a640fe6a5fb58a9d0ca3

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_hu.dll

                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  840e859d33976a45d9aa79b4c5160d33

                                                                                                                                                  SHA1

                                                                                                                                                  6522f4d21e80b7f83ab920640914dab9ac2dba5a

                                                                                                                                                  SHA256

                                                                                                                                                  edc63fc935d0de9fafcb06ef7e985009653f3650e3460a6e74272aa518ae3db1

                                                                                                                                                  SHA512

                                                                                                                                                  8f4c71265d0f01a88960686cceb8489eb2be2683cd6de697d4474553debd4646d9dc23f9bec53a028375f8da9cbba27dccb8b861720865b285e32bcfb0e8828a

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_id.dll

                                                                                                                                                  Filesize

                                                                                                                                                  42KB

                                                                                                                                                  MD5

                                                                                                                                                  2bebedf7006e01182b4724cdccdf8209

                                                                                                                                                  SHA1

                                                                                                                                                  d29e8371a2fd2fb5673ec26bce9a76aec61fcd0b

                                                                                                                                                  SHA256

                                                                                                                                                  a57a4d3f382f02ef972dcec0b92ff766e8dff63638deba1925e4360a391202ec

                                                                                                                                                  SHA512

                                                                                                                                                  605cb76437c2cc7868f88e24a09fb61d9ef81e104d1471443806c7cc31500b92d90b8f014d8aecbb85cdbbf2d9d6950e95da1d0f3ff6e6f5b195c54c17df7b1f

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_is.dll

                                                                                                                                                  Filesize

                                                                                                                                                  42KB

                                                                                                                                                  MD5

                                                                                                                                                  1501833c6ba1afd0be75f245359aaef3

                                                                                                                                                  SHA1

                                                                                                                                                  5380a6501658d195008da7fe4934d3f229fce5ff

                                                                                                                                                  SHA256

                                                                                                                                                  08adde568bc6e0b19da788fa5de81a5817faa7a750c926989e73f1c2be40573d

                                                                                                                                                  SHA512

                                                                                                                                                  bd0ac891af264c25e264bb7562ce0ed9ed02a6d34488fd684c9cf8a4936482a072d30e1939a5042a4e10b399454804f00d45af24f2c8fbddc01653b0d90236f1

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_it.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  a70215145e52353fa80de6604ce5095d

                                                                                                                                                  SHA1

                                                                                                                                                  26cfcbf62d47c7830f53135f321cf559c9cf403f

                                                                                                                                                  SHA256

                                                                                                                                                  9f7f4d8a0683c64a3657801cfc399ce390ba1138fd90120f49c601afc9a88cdb

                                                                                                                                                  SHA512

                                                                                                                                                  27872c2cc2c0fa49146ede7e4061b3ce2322415ff8f9ff5703491c8b64ca0735207a64e520237d8174706e0e915f28862eef71a2f9d804ee02512095f87d4ab1

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_iw.dll

                                                                                                                                                  Filesize

                                                                                                                                                  40KB

                                                                                                                                                  MD5

                                                                                                                                                  052f862b897a8e59a203ccaacd5ad09b

                                                                                                                                                  SHA1

                                                                                                                                                  07734dcf9c61c51389836e04e3b0125d7498b632

                                                                                                                                                  SHA256

                                                                                                                                                  c1bc29fd83d244a5d20674d90e98d995a255c9dccf90881f028bf35eed8b6276

                                                                                                                                                  SHA512

                                                                                                                                                  949378b1fa5ec568b99456bd475570565ea8adc01dfa387d3f87808a9c2037b82613120117e0f582bc65eb619ce7d0b2e447148236bd0262bcab5e3d475fd202

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_ja.dll

                                                                                                                                                  Filesize

                                                                                                                                                  39KB

                                                                                                                                                  MD5

                                                                                                                                                  ee568bafe0eaef79ec54688d04816e42

                                                                                                                                                  SHA1

                                                                                                                                                  75c46969898fe1326a211c99ba03bdf2f42fa4ae

                                                                                                                                                  SHA256

                                                                                                                                                  adbdb88fac6f4b7af1c845774e870f356aa7018ccccdd10196b10f18b9b0b2e3

                                                                                                                                                  SHA512

                                                                                                                                                  2cb1568bbff7d338baeee2f5c82a003aad0e17671857afb956cc7026e19f28a1da1a5b3d3b362f0ea70bb9a1365a07445278f658aa9cab290a9e8b97ef7dbf9e

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_kn.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  d876ced6baff678cbdf14031fbde9631

                                                                                                                                                  SHA1

                                                                                                                                                  fda2dbeca454660ecec9ba1337b0753f89c75549

                                                                                                                                                  SHA256

                                                                                                                                                  2613a42698211413ad94a5854e4e3fac172abebfebb4eac12a75a042aefa971a

                                                                                                                                                  SHA512

                                                                                                                                                  1cd48b49ba164491bff2a8e3a2c5a033d4aae30b2722f601f42db7d58284be4630c8bb45f24b505cc066171a9eab7700707d4ae91a5bada2644eb1a4b36798b5

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_ko.dll

                                                                                                                                                  Filesize

                                                                                                                                                  39KB

                                                                                                                                                  MD5

                                                                                                                                                  2b67991318d781869538f48452bdb153

                                                                                                                                                  SHA1

                                                                                                                                                  d008b609e56568078cfbff28b6e549f940c6fe96

                                                                                                                                                  SHA256

                                                                                                                                                  520345af1b837d49bfeea54de3b7957334c998dcdac77083fd5877a494250168

                                                                                                                                                  SHA512

                                                                                                                                                  1774a4bc5da769cf2f3593feabb1a5561ecb4606916d6f66b097511595a5a0718f839e55e7ec55052451c5d0f9320a3c64c43adac103c3463b3c0ff9d8cbc191

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_lt.dll

                                                                                                                                                  Filesize

                                                                                                                                                  42KB

                                                                                                                                                  MD5

                                                                                                                                                  c3b9e9ac6cead1e698c30dbc081b89a6

                                                                                                                                                  SHA1

                                                                                                                                                  6ac2b98c80decf71f328a65c894365cede7f732c

                                                                                                                                                  SHA256

                                                                                                                                                  da25075045e7caf14116921758ad7071abd16ca16ad30aeac51424ebe2fc8059

                                                                                                                                                  SHA512

                                                                                                                                                  e4dc34f339f3a465f46d7f7cb26852e65455016d6fa1319ab4b5d04fc80a67035c87f50bbe4afcffb3b0a4912669b9b0a441325c40d0ce522d2286e794200c41

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_lv.dll

                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  2e67805ec1c2f327cd75145dfb6c0b4b

                                                                                                                                                  SHA1

                                                                                                                                                  40464bd191080fba9c7287994f0ad171c9b9d0fa

                                                                                                                                                  SHA256

                                                                                                                                                  3547e9a1cdb6f0337b704754504068cda39e4075803078e37dafaf474962e71d

                                                                                                                                                  SHA512

                                                                                                                                                  da12838e1151a0673a043b3eb6a8d9ddf80e62da3fa1b872cd5a0d263bbb228330bb5f29b34c37a8e00f5e28b35cfc5cb3143d3132ea10c060d2bf4bd003831b

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_ml.dll

                                                                                                                                                  Filesize

                                                                                                                                                  46KB

                                                                                                                                                  MD5

                                                                                                                                                  77247706328fc4cc32b7547b1aaa44a0

                                                                                                                                                  SHA1

                                                                                                                                                  83816340fa190b967a6a2a34110f822a8732e1d4

                                                                                                                                                  SHA256

                                                                                                                                                  3c78a482ee4f94bf5a3cfe231ccc7d96bca83f96f621f5f6f167113e651f8aff

                                                                                                                                                  SHA512

                                                                                                                                                  22347f94e900c16bef181c3cbb9518b1b2dfe27923bb108d4cd39a497d36d5c3d515eee13a027c3398130e9defb389b4d8f0cef9d2bb78932a6f04b849c85913

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_mr.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  dfda61f8be51a23ea3ceb7bf9c8de9fa

                                                                                                                                                  SHA1

                                                                                                                                                  72f703928853390656f70426c3537a620274579c

                                                                                                                                                  SHA256

                                                                                                                                                  67de42666b554a07ba14c5150bbcae7f0af8f4e082ec7e9655e6a0cff0d8e061

                                                                                                                                                  SHA512

                                                                                                                                                  c5cbbc5d47bad734d8317e87e0a1efc374f8a19656531131e29e5b7c202e810def3c0cd8ccba92bd913986068020a217fdee7b48eba952d2e71ae351f20f0f6e

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_ms.dll

                                                                                                                                                  Filesize

                                                                                                                                                  42KB

                                                                                                                                                  MD5

                                                                                                                                                  493a33c40fc499a7209f88aebe5ad0f2

                                                                                                                                                  SHA1

                                                                                                                                                  ad33ae69c5e62697a19fda48639726e35a93307f

                                                                                                                                                  SHA256

                                                                                                                                                  7764fd60a1f384380b7e847466690cc5ff4b46b47db86e83f766913e5219a81c

                                                                                                                                                  SHA512

                                                                                                                                                  6bacb662b1a3ccef53fe2d4731b9c27639fa1194b8cebbdd2f508b2b0f96ff09b0757570f1cb46657121f462bde0e942abb1868f331448b742324d37feb248f0

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_nl.dll

                                                                                                                                                  Filesize

                                                                                                                                                  44KB

                                                                                                                                                  MD5

                                                                                                                                                  c520f19e972feda764ec523f8bbab805

                                                                                                                                                  SHA1

                                                                                                                                                  457b874fc7be37be1c46d4733b805e1c0e83bb69

                                                                                                                                                  SHA256

                                                                                                                                                  e4b5d114adad2794f245a300e8a4f18cfdee78740327adc7257cff1854319f9c

                                                                                                                                                  SHA512

                                                                                                                                                  74747bf5bc875a65499bbf82d60f174a6cd8af9ebb103c6a5dfadf7a002c9aa9b06a53c27beb683efe38950303543b0b0a5b1919e48ccef5d5f685d17e5c1aa2

                                                                                                                                                • C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_no.dll

                                                                                                                                                  Filesize

                                                                                                                                                  43KB

                                                                                                                                                  MD5

                                                                                                                                                  db94b8ee999225ba3a038477bfcd7547

                                                                                                                                                  SHA1

                                                                                                                                                  bd2beae660a1cb61eeef93feccce4c22a8cf103e

                                                                                                                                                  SHA256

                                                                                                                                                  e1e4e4ce58b61260d22b464799dee32127901dfaf9ca3fb452dc1d19208989c8

                                                                                                                                                  SHA512

                                                                                                                                                  d2a656d1fa36a33583c223f3fcd53238966e7114004cf36264ceb25251a822b9e3bcd298967951292afa8130d6c3190023643a356c3521495d1a9f0af3d8e00c

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1230661125\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  73B

                                                                                                                                                  MD5

                                                                                                                                                  d0d700d97af7329eba4106663e78eef3

                                                                                                                                                  SHA1

                                                                                                                                                  3edda685dd4c1784f4367145b4bc33c0931a3f52

                                                                                                                                                  SHA256

                                                                                                                                                  e8d45358e5cf9c0d78c905f62747c374e28c0b3104fe63611f795271d68213f3

                                                                                                                                                  SHA512

                                                                                                                                                  28c97cf9009557bdaba19edad046bbe1b0dc6b1c826402beddaa19412bf854fef8bd58f9faaa5091bcd43fa55c65bb69cbad9d2b9b222185e6a3cecddfd3650a

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1327001734\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  108B

                                                                                                                                                  MD5

                                                                                                                                                  54fe5b510967a920d1ea789be84feda6

                                                                                                                                                  SHA1

                                                                                                                                                  35c9a6f3ccabee0e1e79248e740d0124a81ae5d5

                                                                                                                                                  SHA256

                                                                                                                                                  f16740e1d0d02d2921f777589d1d81fa1843af65b3854fb5286e409ce9d27baf

                                                                                                                                                  SHA512

                                                                                                                                                  f4d1a9ebc785cf9b27612c03347b0a0240412ca460ed078581000544f6ac607f4b46a4b3c34e134242fab37e5959522553c60f42b656d36844f7fc285d09a003

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1520998009\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  564B

                                                                                                                                                  MD5

                                                                                                                                                  2efa37b5105fbed3014a7be8963dc2ed

                                                                                                                                                  SHA1

                                                                                                                                                  a03fd940871c3a99836f8f1c3bb2edb5e5a32339

                                                                                                                                                  SHA256

                                                                                                                                                  9961547296bbc34112d1c852fb61ada201f87230e56848c17af3df54ef8921b2

                                                                                                                                                  SHA512

                                                                                                                                                  9b0b86e7c110b5d076d67eca5848e1847a8f04de3feb4a4c71e1d00724fad701b0b0cc3f7dba7450ab3392da4ea5e2353ac9f263b81a5a186b694b5a162db69b

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1587199246\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  76B

                                                                                                                                                  MD5

                                                                                                                                                  4aaa0ed8099ecc1da778a9bc39393808

                                                                                                                                                  SHA1

                                                                                                                                                  0e4a733a5af337f101cfa6bea5ebc153380f7b05

                                                                                                                                                  SHA256

                                                                                                                                                  20b91160e2611d3159ad82857323febc906457756678ab73f305c3a1e399d18d

                                                                                                                                                  SHA512

                                                                                                                                                  dfa942c35e1e5f62dd8840c97693cdbfd6d71a1fd2f42e26cb75b98bb6a1818395ecdf552d46f07dff1e9c74f1493a39e05b14e3409963eff1ada88897152879

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_161333972\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  533B

                                                                                                                                                  MD5

                                                                                                                                                  42009b4dd959e3bc13f18be4df9274fd

                                                                                                                                                  SHA1

                                                                                                                                                  587ae3aa747b57ee96f44ff231efec1cc594dc97

                                                                                                                                                  SHA256

                                                                                                                                                  c9e3cf0c31a16a1a4737fd30b166c6da0a74925590c75026af334c224c022f92

                                                                                                                                                  SHA512

                                                                                                                                                  6a667409d99bfd69b9096fe322eac756e24a96d5a1cff2ff0ef30cbdb66b3355fb00e6914aebbd2fec35107a4e89a5b9981a030e505b8d88cc4a28a6feabc3a8

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1639327008\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  107B

                                                                                                                                                  MD5

                                                                                                                                                  27236395ce59c88a97e8d0dcff44fc45

                                                                                                                                                  SHA1

                                                                                                                                                  e55a2afedd85914131073021d5de4b64dbdbcaa8

                                                                                                                                                  SHA256

                                                                                                                                                  fa0ff36fb3b2a396905448ad1a9d3d0425699424398f9b0fdeadc7c4a961f997

                                                                                                                                                  SHA512

                                                                                                                                                  cba3e76fe2f3ddd71276a26adfb7aa70843bce3ec761356a6f2f3ddc601ca9158a6601b6933d5a4a7342fb92e4be80fc2c851256e85f816a5c3063f6d69aa77a

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1773847304\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  563B

                                                                                                                                                  MD5

                                                                                                                                                  0d45b64d2fd53ca883f50b129a692590

                                                                                                                                                  SHA1

                                                                                                                                                  18cf77d785f43ad87e08d2e4ef47640a359431b2

                                                                                                                                                  SHA256

                                                                                                                                                  cf2c438df5db4fedd73221c4f740648df37122b86b0a70afec20a4d0149e0274

                                                                                                                                                  SHA512

                                                                                                                                                  dd311b5a271bcf4a56101c2bba7caa272bc95d24f456753167a1a6d42a402af122d31ff2ff6a4371315a89c2704bf9347ce67fefd41550c701afc058f5a4598f

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1951857099\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  595B

                                                                                                                                                  MD5

                                                                                                                                                  24cbf42fa8685f11c5ab4269492f095a

                                                                                                                                                  SHA1

                                                                                                                                                  acf60b533f67bd79a5738ed681d9b0d278fff9d4

                                                                                                                                                  SHA256

                                                                                                                                                  370e9495fc58cf995e0449c873f507bb5711aab12a69e9021264cf5152673327

                                                                                                                                                  SHA512

                                                                                                                                                  af1c14d9e9542c7432fab573d3ac906ac549d24e1c7b97a97a9e9992429d86cb07bb1de45a3461dc5a79de7e32247bffd2d1f414db7b46ba39f5765fe5ac5ea5

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-as.hyb

                                                                                                                                                  Filesize

                                                                                                                                                  703B

                                                                                                                                                  MD5

                                                                                                                                                  8961fdd3db036dd43002659a4e4a7365

                                                                                                                                                  SHA1

                                                                                                                                                  7b2fa321d50d5417e6c8d48145e86d15b7ff8321

                                                                                                                                                  SHA256

                                                                                                                                                  c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

                                                                                                                                                  SHA512

                                                                                                                                                  531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-hi.hyb

                                                                                                                                                  Filesize

                                                                                                                                                  687B

                                                                                                                                                  MD5

                                                                                                                                                  0807cf29fc4c5d7d87c1689eb2e0baaa

                                                                                                                                                  SHA1

                                                                                                                                                  d0914fb069469d47a36d339ca70164253fccf022

                                                                                                                                                  SHA256

                                                                                                                                                  f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

                                                                                                                                                  SHA512

                                                                                                                                                  5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-nb.hyb

                                                                                                                                                  Filesize

                                                                                                                                                  141KB

                                                                                                                                                  MD5

                                                                                                                                                  677edd1a17d50f0bd11783f58725d0e7

                                                                                                                                                  SHA1

                                                                                                                                                  98fedc5862c78f3b03daed1ff9efbe5e31c205ee

                                                                                                                                                  SHA256

                                                                                                                                                  c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

                                                                                                                                                  SHA512

                                                                                                                                                  c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  82B

                                                                                                                                                  MD5

                                                                                                                                                  2617c38bed67a4190fc499142b6f2867

                                                                                                                                                  SHA1

                                                                                                                                                  a37f0251cd6be0a6983d9a04193b773f86d31da1

                                                                                                                                                  SHA256

                                                                                                                                                  d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

                                                                                                                                                  SHA512

                                                                                                                                                  b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_2108726891\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  578B

                                                                                                                                                  MD5

                                                                                                                                                  ccbc3b695df774121db4b320b56b0b9d

                                                                                                                                                  SHA1

                                                                                                                                                  9930d54099552e4df1ff0e134069e6c1b0f7334f

                                                                                                                                                  SHA256

                                                                                                                                                  a200101b4ffbabae69af1fd9bb29a21986f1c5e852280d37549740f68bd82608

                                                                                                                                                  SHA512

                                                                                                                                                  5cd5dbd1ca7ea7570950e7271d3246c54de366b84edc60d9c9b573d416d4dadff4d563957dc96ba23090f4a4d3643c32c86040476b40c9eebcace573b4cc8276

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_226800497\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  555B

                                                                                                                                                  MD5

                                                                                                                                                  32c91bf9b8f95b4b2330a1b7d8b6c359

                                                                                                                                                  SHA1

                                                                                                                                                  32589e12e041bbc42fb3a66c489b39ef380fc1fd

                                                                                                                                                  SHA256

                                                                                                                                                  cf65a918306fa7763350fd8464fd2f3a049468424b6b89b15b15d824f0796df1

                                                                                                                                                  SHA512

                                                                                                                                                  2f6582a63caf1d18298b6ff9ac65172609c3444d676c5d1988d329e2dfcca5293b6cf2838dd9a6eaa655cbff403989f47fc4811b41e9a2b4c10e7478b92f384a

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_32548518\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  111B

                                                                                                                                                  MD5

                                                                                                                                                  fecba6c3128a97f09a1173779924be7c

                                                                                                                                                  SHA1

                                                                                                                                                  41645675ff089fc6059bbe1ed4b049502241e7fa

                                                                                                                                                  SHA256

                                                                                                                                                  7ef57c6645a8d144047d276b5d41b153c4dc63cf3627c32db018ae64b4e6d92b

                                                                                                                                                  SHA512

                                                                                                                                                  c1193abe0bb4a9359e8e73332475995bd042149f62a67e67d37549993c7130589db809c53657abb7a0f9c518f975f270debeaf7fa70327a81b8bbee233035aad

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_330063610\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  76B

                                                                                                                                                  MD5

                                                                                                                                                  c08a4e8fe2334119d49ca6967c23850f

                                                                                                                                                  SHA1

                                                                                                                                                  13c566b819d8e087246c80919e938ef2828b5dc4

                                                                                                                                                  SHA256

                                                                                                                                                  5b01512276c45ecc43d4bfa9a912bdaf7afc26150881f2a0119972bffdbd8ab0

                                                                                                                                                  SHA512

                                                                                                                                                  506f9f4fa4baaa4096ce10007eb09cfa95c9188082053b9ff7f2dec65164ff57506b6a8fea28d58783700f257c982aef037afc33f62da8da281e67636430dc23

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_375743047\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  72B

                                                                                                                                                  MD5

                                                                                                                                                  a30b19bb414d78fff00fc7855d6ed5fd

                                                                                                                                                  SHA1

                                                                                                                                                  2a6408f2829e964c578751bf29ec4f702412c11e

                                                                                                                                                  SHA256

                                                                                                                                                  9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

                                                                                                                                                  SHA512

                                                                                                                                                  66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_431131870\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  558B

                                                                                                                                                  MD5

                                                                                                                                                  f2ea88c3713fadc1cb2f57ffc5f763e5

                                                                                                                                                  SHA1

                                                                                                                                                  203adbd539223c4ea2c2f0a549dd198d46bda233

                                                                                                                                                  SHA256

                                                                                                                                                  3ecf70ef4593b2d7ff9955f6f62f656b1a3957b743972f1b615c91ad8b4acd62

                                                                                                                                                  SHA512

                                                                                                                                                  32b8508cdb2b650abf06c6e1507769cca8cbaa99bc654d6ad528872aa1606bb66773142029f78353798c1ea73a4e2ade7c76582340b85206cda0a3de857dc212

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_442332886\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  592B

                                                                                                                                                  MD5

                                                                                                                                                  1e0f7f890284cf0a24663ab1f9accf6e

                                                                                                                                                  SHA1

                                                                                                                                                  c578e29d741313fe58e473b33cdeda91934b8209

                                                                                                                                                  SHA256

                                                                                                                                                  466ec1188e845ee492a56d390648e24ab85616f7a59916499a7edcf0fe8cb300

                                                                                                                                                  SHA512

                                                                                                                                                  4ddef4383afe5c21adbe343a74a67bfa204463110c538b457609e208fe5fa21968ef562dda155c5e1c1eca54b3415fd12019adf5353481d97a7ac9fd667420e7

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_466911274\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  546B

                                                                                                                                                  MD5

                                                                                                                                                  ccc2d62f051e67b70c72b6719493b273

                                                                                                                                                  SHA1

                                                                                                                                                  f59b5076716db275b936b69c84cd661a6c42f0b3

                                                                                                                                                  SHA256

                                                                                                                                                  b01ff84c07c6fbc6bcf265a56f9cb6928d62e19678eef47a5bd81f175179efa7

                                                                                                                                                  SHA512

                                                                                                                                                  7712a6704965a5daca32b59c2b99336ea69555ff4df03ff3d1fc49189bab66363694e062a943f3e29fce564fd90cb5a51902473184bcf12f0c108354fc6f2623

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_507982058\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  95B

                                                                                                                                                  MD5

                                                                                                                                                  cd3300d7571770b1800f4505eeda0f06

                                                                                                                                                  SHA1

                                                                                                                                                  3f6a686d85dc53b90c1fd6724ec476fc38a87b1e

                                                                                                                                                  SHA256

                                                                                                                                                  b4c780a8b36b0a034c4421ab385f5f1dfbc8a86ee876cfa4e14ad65916aa23d6

                                                                                                                                                  SHA512

                                                                                                                                                  e981b7b5d3ca9ddb5dd9a402a08c7f6fe76a79a908ee8c333dd8a26fe48044e09e88139c2037ba6c1d2cd4ab244c10c8de8706652f927d9e5904fdd6f2b44eec

                                                                                                                                                • C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_525795849\manifest.json

                                                                                                                                                  Filesize

                                                                                                                                                  584B

                                                                                                                                                  MD5

                                                                                                                                                  25b253b4d9d9ee54f5cf3cfc03a53ee2

                                                                                                                                                  SHA1

                                                                                                                                                  1312657bc647afc32ad202fe6c00ca479f49de1a

                                                                                                                                                  SHA256

                                                                                                                                                  203e428046ed3c49cb3c05aa83f89e89ff7c342a3b63318f9e315d99cc57f9e4

                                                                                                                                                  SHA512

                                                                                                                                                  18b2535136a8a7e91ecd2185265129c5e24130a6f2f7118bbd29fd5ea3b74a545ec6a635d73ea6947a68e481b72990a531ff2d66f1a75312e1820d168932d21d

                                                                                                                                                • C:\Windows\Temp\__PSScriptPolicyTest_wmjrzjyt.lzh.ps1

                                                                                                                                                  Filesize

                                                                                                                                                  60B

                                                                                                                                                  MD5

                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                  SHA1

                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                  SHA256

                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                  SHA512

                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                • memory/1220-2803-0x0000000000980000-0x0000000000CA4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.1MB

                                                                                                                                                • memory/1412-938-0x0000000072E60000-0x0000000072EC8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  416KB

                                                                                                                                                • memory/1412-870-0x0000000072E60000-0x0000000072EC8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  416KB

                                                                                                                                                • memory/2412-5560-0x000001C86A000000-0x000001C86A0B3000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  716KB

                                                                                                                                                • memory/2924-3310-0x0000025F09190000-0x0000025F09191000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2924-3312-0x0000025F09190000-0x0000025F09191000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2924-3313-0x0000025F09190000-0x0000025F09191000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2924-3304-0x0000025F09190000-0x0000025F09191000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2924-3315-0x0000025F09190000-0x0000025F09191000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2924-3306-0x0000025F09190000-0x0000025F09191000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2924-3316-0x0000025F09190000-0x0000025F09191000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2924-3305-0x0000025F09190000-0x0000025F09191000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2924-3311-0x0000025F09190000-0x0000025F09191000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2924-3314-0x0000025F09190000-0x0000025F09191000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/5040-2876-0x000000001C550000-0x000000001CA78000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  5.2MB

                                                                                                                                                • memory/5040-2849-0x000000001BD60000-0x000000001BE12000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  712KB

                                                                                                                                                • memory/5040-2848-0x000000001BC50000-0x000000001BCA0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  320KB

                                                                                                                                                • memory/5812-5427-0x000001F0D57F0000-0x000001F0D58A3000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  716KB

                                                                                                                                                • memory/6060-5532-0x000001EFF8030000-0x000001EFF81F2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.8MB

                                                                                                                                                • memory/6100-5330-0x000001B62FD50000-0x000001B62FD5E000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  56KB

                                                                                                                                                • memory/6100-5329-0x000001B62FD70000-0x000001B62FD8C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  112KB

                                                                                                                                                • memory/6100-5309-0x000001B617A10000-0x000001B617A32000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  136KB

                                                                                                                                                • memory/6100-5328-0x000001B62FD40000-0x000001B62FD4A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  40KB

                                                                                                                                                • memory/6100-5326-0x000001B62FC60000-0x000001B62FC7C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  112KB

                                                                                                                                                • memory/6100-5327-0x000001B62FC80000-0x000001B62FD33000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  716KB

                                                                                                                                                • memory/6100-5331-0x000001B62FDB0000-0x000001B62FDCA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  104KB